The vulnerability is a missing authorization check in the TicketFlowHistoryView of loonflow, allowing any authenticated user to request the ticket_flow_history endpoint for a ticket UUID that owns no privileges over. The endpoint returns the ticket’s flow history, including approval comments, processor names, emails, and phone numbers, which constitutes a privacy breach for other users’ personal and sensitive data.

The affected product is blackholll’s loonflow. Any deployment running a version before r3.2.3 is vulnerable; the issue was resolved starting in r3.2.3, so all releases older than that should be considered affected.

The CVSS score of 2.3 indicates a low risk of exploitation compared to other vulnerabilities. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, reducing the perceived urgency. However, any authenticated user—who may already have access to the system—can exploit the flaw, so the attack vector requires only legitimate credentials but not elevated privileges. The overall exposure is limited to data confidentiality breaches rather than system compromise.