-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-kernel | composer | >= 1.3.0, < 1.3.26 | 1.3.26 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from an insecure policy configuration rather than a specific code function. The critical change in the fix was adding MemberOf and Role limitations to the 'role/assign' policy in policies.yml. Prior to the patch, this policy had no restrictions (~), allowing users with the Company Admin role (or any user granted this policy) to assign arbitrary roles regardless of subtree limitations. The absence of these limitations in the policy configuration was the root cause, making the policy definition itself the vulnerable component.
A Semantic Attack on Google Gemini - Read the Latest Research