Authorization Bypass in I hate money
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| spiral-project | ihatemoney | before 4.1.5 | 4.1.5 | Patch available | CNA |
| — | ihatemoney (PyPI) | before 4.1.5 | 4.1.5 | Patch available | GHSA-67j9-c52g-w2q9 |
- ihatemoney Vendorspiral-project Affected before 4.1.5 Fixed in 4.1.5 Patch available CNA
- ihatemoney (PyPI) Vendor— Affected before 4.1.5 Fixed in 4.1.5 Patch available GHSA-67j9-c52g-w2q9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ihatemoney:i_hate_money:*:*:*:*:*:*:*:* | before 4.1.5 | Vulnerable | Ihatemoney |
- cpe:2.3:a:ihatemoney:i_hate_money:*:*:*:*:*:*:*:* Versions before 4.1.5 Vulnerable ·Ihatemoney
Remediation
- Fix · CNA ihatemoney (spiral-project) Fixed in 4.1.5
- Fix · GHSA-67j9-c52g-w2q9 ihatemoney (PyPI) Fixed in 4.1.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15120
- 2026-10-03 Alias added: GHSA-67j9-c52g-w2q9
References
Advisory 2
Sources
- CVE-2020-15120 · CVE Program
- CVE-2020-15120 · NVD
- FIRST EPSS
- GHSA-67j9-c52g-w2q9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences