Medium

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Disclosed: 07.03.2026
Updated: 11.10.2026 10:22

Summary

The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status.

Affected Endpoints

GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check.
GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check.

Root Cause (1-of-N Inconsistency)

Other methods in the same controller properly check for the 'owner' role:

store() — UserStoreRequest::authorize() checks auth()->user()->hasRole('owner') ✓
destroy() — Explicitly checks $this->repository->hasRole($admin, 'owner') ✓

But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware.

Exposed Data

The UserTransformer (line 40-54) returns:

email — user's email address
role — user's role (owner/demo)
blocked — account blocked status
blocked_code — block reason
created_at / updated_at — timestamps

Impact

Any authenticated user can:

Enumerate ALL user accounts in the instance
Harvest email addresses for phishing/social engineering
Identify admin/owner accounts by role
Determine which accounts are blocked

Exploitation

bash

# List all users
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users

# View specific user details
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users/1

Suggested Fix

Add owner role checks to index() and show(), or restrict the route group with admin middleware:

php

// Option 1: Add check in controller methods
public function show(User $user): JsonResponse
{
    if (!$this->repository->hasRole(auth()->user(), 'owner') && auth()->user()->id !== $user->id) {
        throw new FireflyException('200025: No access to function.');
    }
    // ...
}

// Option 2: Add middleware to route group
Route::group(['middleware' => ['admin'], ...], ...)

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	grumpydictator/firefly-iii	>= 6.4.23, < 6.5.1	6.5.1

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-863
Platform: Composer
Package: grumpydictator/firefly-iii
Disclosed: 07.03.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5q8v-j673-m5v4 - CC BY 4.0

Vulnerability history: grumpydictator/firefly-iii

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (26) in the archive

Total entries: 26
First → latest: 08.2021 06.2026
Without a fix: 3
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1
Medium 22
Low 2

Disclosures per year

2021: 12
2022: 5
2023: 3
2024: 3
2025: 0
2026: 3

15.06.2026

Project Firefly III has incorrect access control in the webhook management component

Critical · 9.1 CVE-2026-50886 <= 6.5.9 no fix
07.03.2026

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) this entry

Medium ghsa-5q8v-j673-m5v4 >= 6.4.23, < 6.5.1 6.5.1
24.05.2022

Unrestricted File Upload vulnerability in Firefly III

High · 8.8 CVE-2021-3846 < 5.6.2 5.6.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application