TI-2026-85048 CVE-2026-121937 · GHSA-9h6j-f6mw-p7qh
Missing authorization in loonflow exposes ticket history to users
Priority MEDIUM 45
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID.