Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the ApiEntityListQuickCreationCommandController class, specifically within the create and store methods. These methods are the endpoints for the 'Quick Creation Command' feature. The security advisory and the patch clearly indicate that these endpoints were missing authorization checks. The create method is used to fetch the form for creating a new entity, and the store method is used to persist the new entity. The patch, commit aa18a85fd8fef830988a336cad2278986729d21a, rectifies this by adding a call to $this->authorizationManager->check('create', $entityKey); at the beginning of both methods. This ensures that a user must have the appropriate 'create' permission for the given entity before they can either view the creation form or submit a new record. An exploit would involve an authenticated but unauthorized user sending a request to the create or store endpoints for an entity, allowing them to either see the creation form or create a new record, bypassing the intended security policy.
Code16\Sharp\Http\Controllers\Api\Commands\ApiEntityListQuickCreationCommandController::createsrc/Http/Controllers/Api/Commands/ApiEntityListQuickCreationCommandController.php
Code16\Sharp\Http\Controllers\Api\Commands\ApiEntityListQuickCreationCommandController::storesrc/Http/Controllers/Api/Commands/ApiEntityListQuickCreationCommandController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code16/sharp | composer | >= 9.0.0, < 9.22.3 | 9.22.3 |