CVE-2026-121937

LOW 3.1

loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers.

CWE	CWE-639
Vendor	blackholll
Product	loonflow
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for blackholll loonflow

Be the first to know when new low vulnerabilities affecting blackholll loonflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

blackholll / loonflow

0 < r3.2.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/blackholll/loonflow/issues/591 hackmd.io: https://hackmd.io/@hieuPenguinnn/loonflow-ticket-flow-history-idor github.com: https://github.com/blackholll/loonflow/commit/a6495b0c2ca9e5dede8e49217a0468bcfa946de4 github.com: https://github.com/blackholll/loonflow/blob/r3.2.2/backend/apps/ticket/views.py#L265-L286 vulncheck.com: https://www.vulncheck.com/advisories/loonflow-before-r3-2.3-idor-via-ticket-flow-history-endpoint

Credits

hieuPenguinnn