Executive brief
ITFlow, an IT management and ticketing platform for service providers, contains a security flaw that allows staff members to view sensitive information they are not authorized to see. A technician with low-level access can bypass internal restrictions to view plaintext passwords and two-factor authentication (TOTP) secrets belonging to other clients. This could lead to unauthorized access to client systems and a significant breach of customer data privacy.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in ITFlow prior to version 26.05. The 'credential_edit.php' endpoint fails to implement client scoping or call 'enforceClientAccess()', allowing any authenticated agent to request an arbitrary 'credential_id'. By directly accessing the modal via a crafted GET request, an attacker can trigger the server to load and decrypt sensitive fields, including 'credential_password' and 'otp_secret', for records belonging to tenants they are not permitted to manage. A related AJAX endpoint 'get_totp_token_via_id' is also affected, allowing the generation of live 2FA codes for unauthorized records. The issue is resolved in version 26.05.
Affected products
- itflow-org ITFlow < 26.05
Timeline
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: NVD publication date