Threats tagged 'ghsa-jgmc-v3xf-562q'

Krayin CRM versions before 2.2.8 have a broken object level authorization vulnerability in the Lead TagController's attach and detach actions. This flaw allows authenticated users with restricted data scopes to add or remove tags on leads owned by users outside their authorized scope.