Threats tagged 'ghsa-9h6j-f6mw-p7qh'

loonflow versions before r3.2.3 have a missing authorization vulnerability in the TicketFlowHistoryView component. This flaw allows any authenticated user to access other users' ticket flow history by providing a ticket UUID. Exploiting this issue, attackers can retrieve sensitive information such as approval comments and processor contact details without proper permission checks.