CVE-2026-47755mediumCWE-639CWE-862

CVE-2026-47755: falha de média gravidade em itflow-org itflow

ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar itflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
itflow-org · itflow
CVEs relacionadas — itflow-org itflow

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54596HIGHITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database ExfiltrationEPSS 0.5%CVE-2026-54597HIGHITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires ParameterEPSS 0.4%