Missing Authorization Vulnerability in Loonflow TicketFlowHistoryView
CVE-2026-121937
2.3LOW
What is CVE-2026-121937?
A security concern has been identified in Loonflow versions prior to r3.2.3, where a lack of proper authorization checks in the TicketFlowHistoryView can allow any authenticated user to access the ticket flow history of other users. By providing a ticket UUID, malicious users are able to exploit the ticket_flow_history endpoint, bypassing the crucial ticket_view_permission_check. This enables them to obtain sensitive information including approval comments, processor names, and personal details such as emails and phone numbers associated with tickets. Organizations using this version of Loonflow should upgrade immediately to mitigate this risk.
Affected Version(s)
loonflow 0