Threats tagged 'ghsa-v84h-gfv8-x79x'

Sure versions 0.7.0 through 0.7.6-alpha.6 have a missing authorization vulnerability in the Transactions::BulkUpdatesController#create function. This flaw allows authenticated family members with read-only or no sharing permissions to modify other members' transaction details such as dates, names, notes, categories, merchants, and tags. This can lead to corruption of budgets and reports.