Marcos García

An authorization bypass exists in the transaction API that allows an authenticated user to read financial records belonging to other companies on the same instance. This occurs because the system fails to implement company scoping or permission checks when processing requests. The issue is triggered via an incremented identifier in the GET '/api/transaction/{id}' endpoint, specifically affecting the `id` variable.

A stored cross-site scripting issue exists in the user management component. An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user by providing a crafted username. This occurs because the frontend uses the `escapeHTML()` function before inserting the username into the `onclick` attribute of the account deletion button. Since browsers HTML-decode attribute values before the JavaScript engine parses the handler, an encoded single quote (') can be used to break out of the string literal and inject malicious code that executes when the victim clicks the delete button.

Authenticated users can execute arbitrary JavaScript within the application origin due to a Cross-site Scripting issue in the finding renderer. This occurs when HTML markup stored in the `severity` field of a finding is interpolated unescaped into class and style attributes during report rendering.

Stored Cross-site Scripting occurs in the client-side report rendering functions `renderPreview()`, `renderEditor()`, and `renderAuditData()` located in js/app.js. A remote, authenticated attacker can execute arbitrary JavaScript in the browser of any user viewing an affected report. This is possible because payloads stored in a finding's `images` array or a report's `client logo` array are interpolated into an <img> src attribute without proper escaping.