Threats tagged 'ghsa-m3f2-9g2h-fgj9'

A security flaw in InvoiceShelf versions up to 2.4.3 and 3.0.0-alpha.3 allows improper access control due to manipulation of the companies[].id and companies[].role arguments in the MemberService::create function. This vulnerability can be exploited remotely and public exploit code is available. Upgrading to versions 2.4.4 or 3.0.0-alpha.4 resolves the issue.