-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing enforcement of subtree and role-based limitations during role assignment. The commit adds MemberOfLimitationMapper and RoleLimitationMapper, which implement critical checks for these limitations. Their absence in vulnerable versions meant the system failed to validate() whether users had the proper permissions to assign roles within subtree constraints. The addition of these mappers in the fix directly addresses the bypass, confirming their related methods were the missing safeguards.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-admin-ui | composer | >= 1.5.0, < 1.5.29 | 1.5.29 |
| ezsystems/ezplatform-admin-ui | composer | >= 2.3.0, < 2.3.26 | 2.3.26 |