CVE-2020-15120

CVE-2020-15120 concerns I hate money prior to 4.1.5, where an authenticated member of one project could modify or delete members of another project and access all bills of that project. Root cause involves insufficient project-scoped checks, enabling cross-project membership alterations once an a...

CVE-2020-15120 Authorization Bypass in I hate money

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's...