Threats affecting pkg:github/loonflow

A missing authorization vulnerability in loonflow before version r3.2.3 allows any authenticated user to access other users' ticket flow history by supplying a ticket UUID. This flaw occurs in the TicketFlowHistoryView, where the ticket_view_permission_check is bypassed, exposing sensitive information such as approval comments and processor contact details.