-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper group membership updates where revocations are ignored. The commit diff shows both SetUserGroups functions in boltdb.go and dynamodb.go were modified to replace append operations with direct assignment. The original code accumulated groups through multiple logins (CWE-269 Improper Privilege Management), while the patch fixes this by overwriting groups. Both functions directly match the vulnerability description and patch changes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zotregistry.dev/zot | go | <= 2.1.1 | 2.1.2 |
A Semantic Attack on Google Gemini - Read the Latest Research