-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 6.4.2 | 6.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper authorization in group membership handling within the UsersController's update method. The original code (pre-patch) checked for superuser status after validating group data and inside multiple conditional branches, allowing non-superusers with API access to bypass authorization by providing a 'groups' parameter. The patch moved the Auth::user()->isSuperUser() check to the top-level conditional, making it a prerequisite for any group modifications. This demonstrates the vulnerable function was directly responsible for handling group permissions without proper authorization gating.
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report