CVE-2026-121937: loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to obtain approval comments and processor names, emails and phone numbers.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated loonflow user can exploit it. The attacker needs a ticket UUID for a ticket whose flow history they are not authorized to view.
What information could be exposed?
The affected endpoint can disclose approval comments and processor names, email addresses, and phone numbers from other users' ticket flow histories.
Which deployments are affected?
loonflow versions before r3.2.3 are affected. The issue is in TicketFlowHistoryView, where the ticket_flow_history endpoint does not perform ticket_view_permission_check.
How can I check for exposure?
Review access and application logs for authenticated requests to the ticket_flow_history endpoint, particularly requests for ticket UUIDs not associated with the requesting user. Confirm whether the deployed version is earlier than r3.2.3.