Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

5.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. Affected Endpoints 1. GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check. 2. GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check. Root Cause (1-of-N Inconsistency) Other methods in the same controller properly check for the 'owner' role: - store() — UserStoreRequest::authorize() checks auth()-user()-hasRole('owner') ✓ - destroy() — Explicitly checks $this-repository-hasRole($admin, 'owner') ✓ But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware. Exposed Data The UserTransformer (line 40-54) returns: - email — user's email address - role — user's role…

Published by the source

7 Mar 2026, 02:10 UTC

Last modified by the source

7 Mar 2026, 02:10 UTC

Source last checked

26 Oct 2026, 14:38 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-5q8v-j673-m5v4

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-5q8v-j673-m5v4

Advisory: Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
IDs: GHSA-5q8v-j673-m5v4
Record: https://patchnext.com/advisories/ghsa-5q8v-j673-m5v4 (revision 1, source checked 26 Oct 2026, 14:38 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: grumpydictator/firefly-iii 6.5.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist grumpydictator/firefly-iii: affected >= 6.4.23, <= 6.5.0; fixed in 6.5.1

## Suggested inspection (read-only)
- Packagist grumpydictator/firefly-iii: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on grumpydictator/firefly-iii.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-5q8v-j673-m5v4 (GitHub-reviewed advisory GHSA-5q8v-j673-m5v4 lists affected ranges: Packagist grumpydictator/firefly-iii >=6.4.23 <=6.5.0)

Commands are suggestions: review each one before running it.