Threats tagged 'ghsa-697f-vmv6-cx6w'

Phproject versions from 1.1.6 up to but not including 1.8.7 have a missing object-level authorization vulnerability in the REST API issue endpoints. Authenticated API key holders can bypass confidentiality controls to read restricted issue data and post unauthorized comments. This vulnerability allows access to sensitive information such as owner and author email addresses.