Description
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.
Published: 2026-07-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ITFlow allows a low‑privileged authenticated user to retrieve plaintext credentials and TOTP secrets for other clients by requesting a credential edit modal with an arbitrary credential_id. The endpoint fails to enforce client scoping or object‑level authorization before decrypting the credential record, enabling an attacker to read sensitive information belonging to a different tenant. This vulnerability is classified as CWE‑639 and CWE‑862.

Affected Systems

The product itflow by itflow‑org is affected. Versions prior to 26.05 are vulnerable; the issue was fixed in version 26.05. Users running v26.04 or older must update.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of <1% suggests a low exploit probability. The vulnerability is not listed in CISA KEV. Exploitation requires authentication but does not require high privileges; an attacker can craft HTTP requests with a valid credential_id to access other clients’ credentials.

Generated by OpenCVE AI on August 3, 2026 at 21:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading to ITFlow version 26.05 or later.
  • If an upgrade is not immediately possible, restrict API access to the credential edit endpoint, ensuring that only members of the owning tenant can request the modal.
  • Implement object‑level authorization checks to verify that the requesting user belongs to the same client as the credential before decrypting and returning the data.

Generated by OpenCVE AI on August 3, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Itflow
Itflow itflow
Vendors & Products Itflow
Itflow itflow

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.
Title ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
Weaknesses CWE-639
CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Itflow Itflow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-28T14:55:37.555Z

Reserved: 2026-05-19T22:16:39.505Z

Link: CVE-2026-47755

cve-icon Vulnrichment

Updated: 2026-07-28T14:25:25.327Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T18:16:53.780

Modified: 2026-07-28T16:18:15.960

Link: CVE-2026-47755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T21:15:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-862

    Missing Authorization