PT-2026-136957
CVE-2026-121937
·
تاريخ النشر
2026-11-04
·
تاريخ التحديث
2026-11-04
الوصف من
CVSS 3.1
3.1
منخفضةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket flow history endpoint, which skips ticket view permission check, to obtain approval comments and processor names, emails and phone numbers.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾