CVE-2026-121937 · Package
NO FIX YET · SEE WHAT TO DO
Loonflow, a ticket workflow system, skips its ticket permission check on the ticket flow history endpoint. Any authenticated user who knows a ticket UUID can read approval comments and processor names, emails and phone numbers.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run Loonflow for internal ticketing or approvals with more than one class of logged-in user. The flaw needs an account and a ticket UUID, so single-user or fully trusted deployments carry little exposure. unknown for other configurations.
Not affected if single-user-deployment, version-r3.2.3-or-later
Who cares loonflow, self-hosted, ticketing
r3.2.3.ticket_flow_history endpoint in your deployment and confirm whether it is reachable by ordinary logged-in users.r3.2.3 or later.loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers.
This page as .md · .json · in your agent: get_signal("CVE-2026-121937") · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.