Media

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Publicada: 07.03.2026
Actualizado: 11.10.2026 10:22

Summary

The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status.

Affected Endpoints

GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check.
GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check.

Root Cause (1-of-N Inconsistency)

Other methods in the same controller properly check for the 'owner' role:

store() — UserStoreRequest::authorize() checks auth()->user()->hasRole('owner') ✓
destroy() — Explicitly checks $this->repository->hasRole($admin, 'owner') ✓

But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware.

Exposed Data

The UserTransformer (line 40-54) returns:

email — user's email address
role — user's role (owner/demo)
blocked — account blocked status
blocked_code — block reason
created_at / updated_at — timestamps

Impact

Any authenticated user can:

Enumerate ALL user accounts in the instance
Harvest email addresses for phishing/social engineering
Identify admin/owner accounts by role
Determine which accounts are blocked

Exploitation

bash

# List all users
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users

# View specific user details
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users/1

Suggested Fix

Add owner role checks to index() and show(), or restrict the route group with admin middleware:

php

// Option 1: Add check in controller methods
public function show(User $user): JsonResponse
{
    if (!$this->repository->hasRole(auth()->user(), 'owner') && auth()->user()->id !== $user->id) {
        throw new FireflyException('200025: No access to function.');
    }
    // ...
}

// Option 2: Add middleware to route group
Route::group(['middleware' => ['admin'], ...], ...)

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	grumpydictator/firefly-iii	>= 6.4.23, < 6.5.1	6.5.1

Referencias

Puntuación CVSS -

Vector CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Debilidad (CWE): CWE-863
Plataforma: Composer
Paquete: grumpydictator/firefly-iii
Publicada: 07.03.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-5q8v-j673-m5v4 - CC BY 4.0

Historial de vulnerabilidades: grumpydictator/firefly-iii

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (26) en el archivo

Entradas en total: 26
Primera → última: 08.2021 06.2026
Sin corrección: 3
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 1
Media 22
Baja 2

Divulgaciones por año

2021: 12
2022: 5
2023: 3
2024: 3
2025: 0
2026: 3

15.06.2026

Project Firefly III has incorrect access control in the webhook management component

Crítica · 9.1 CVE-2026-50886 <= 6.5.9 sin corrección
07.03.2026

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) esta entrada

Media ghsa-5q8v-j673-m5v4 >= 6.4.23, < 6.5.1 6.5.1
24.05.2022

Unrestricted File Upload vulnerability in Firefly III

Alta · 8.8 CVE-2021-3846 < 5.6.2 5.6.2

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación