kurrier-org vulnerabilities and threats

Kurrier versions prior to 1.2.4 have an authorization bypass vulnerability in API endpoints for listing and retrieving webhook and identity resources. Authenticated users with valid API keys could access metadata of other users' webhook and identity resources by using identifiers from those accounts. This issue affects GET and list operations but does not allow anonymous access or cross-user modifications. The vulnerability is fixed in version 1.2.4.