PT-2026-136957

CVE-2026-121937

·

Published

2026-11-04

·

Updated

2026-11-04

Description by

CVSS 3.1
3.1
Low
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket flow history endpoint, which skips ticket view permission check, to obtain approval comments and processor names, emails and phone numbers.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2026-121937
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com