Improper authorization control for web services In python-sure
Description
A flaw was found in sure. A missing authorization check in the bulk update functionality allows authenticated users with restricted or read-only permissions to bypass account sharing restrictions. By submitting arbitrary transaction identifiers during a bulk update request, an attacker can modify another member's transaction details, leading to unauthorized data modification and corrupted financial reports.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component |
|---|---|
 rpm rhel8 |
Aliases
1. 2. 3.