CVE-2026-121937

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...

CVE-2026-121937 loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...

EUVD-2026-116894

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...

CVE-2026-121937

Versions of loonflow prior to r3.2.3 are vulnerable to a missing authorization flaw in the TicketFlowHistoryView component. By providing a ticket UUID, an authenticated user can access the ticket_flow_history endpoint, which fails to perform a ticket_view_permission_check . This allows unauthoriz...

CVE-2026-121937 loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...

PT-2026-136957

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket flow history endpoint, which skips ticket view permission check, ...

CVE-2026-121937: blackholll loonflow: loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any…

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...