Threats tagged 'ghsa-vj8j-w6v9-74w8'

Dolibarr versions 20.0.0 through 23.0.4 and 24.x before 24.0.2 contain an insecure direct object reference (IDOR) vulnerability in the api_expensereports.class.php payment endpoints. This flaw allows authenticated users with expense report read and create permissions to access, create, or modify other users' expense report payments, potentially falsifying reimbursement states.