Executive brief
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Affected products
- Packagist grumpydictator/firefly-iii
Junglewise Threat Intelligence
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Severity: medium · CVSS 4 · Published 2026-03-07
Technologies: grumpydictator/firefly-iii (Packagist). Vendors: Packagist.