vulnerability / NVI-00008032 / Revision 1
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
OSV carries this publisher advisory for grumpydictator/firefly-iii. This is an aggregated source copy; consult the original publisher and compare update dates.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
grumpydictator/firefly-iii
source listedECOSYSTEM: introduced 6.4.23; fixed 6.5.1
### Summary The User management API endpoints (`GET /api/v1/users` and `GET /api/v1/users/{id}`) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. ### Affected Endpoints 1. **GET /api/v1/users** (UserController::index, line 94) — Lists ALL users with full details. No role check. 2. **GET /api/v1/users/{id}** (UserController::show, line 126) — Shows any user's details by ID. No role check. ### Root Cause (1-of-N Inconsistency) Other methods in the same controller properly check for the 'owner' role: - `store()` — `UserStoreRequest::authorize()` checks `auth()->user()->hasRole('owner')` ✓ - `destroy()` — Explicitly checks `$this->repository->hasRole($admin, 'owner')` ✓ But `index()` and `show()` have no role check at all. The route group at `routes/api.php:734-747` has no admin middleware, only the global `auth:api` middleware. ### Exposed Data The `UserTransformer` (line 40-54) returns: - `email` — user's email address - `role` — user's role (owner/demo) - `blocked` — account blocked status - `blocked_code` — block reason - `created_at` / `updated_at` — timestamps ### Impact Any
03 / Response
What to do next
- vendor patch
The original advisory lists fixed boundaries 6.5.1 for grumpydictator/firefly-iii. Confirm the publisher’s latest guidance.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-5q8v-j673-m5v4 ↗
GitHub Advisory Database via OSV · vendor advisory
Observed . GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.