{"action":"Upgrade pageflow to 14.5.2 or later.","affected":[{"fixed":"14.5.2","introduced":"0"},{"fixed":"15.7.1","introduced":"15.0.0"}],"component":"pageflow","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["14.5.2","15.7.1"],"ghsa_id":"GHSA-qcqv-38jg-2r43","id":"tcs_01M5KEMY5GP1PKV4RQ9RYQ1S2S","modified_at":"2024-12-06T05:27:05.199086Z","published_at":"2022-09-15T03:21:41Z","references":["https://osv.dev/vulnerability/GHSA-qcqv-38jg-2r43","https://github.com/codevise/pageflow/security/advisories/GHSA-qcqv-38jg-2r43","https://github.com/codevise/pageflow/pull/1862","https://github.com/codevise/pageflow"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-qcqv-38jg-2r43","url":"https://osv.dev/vulnerability/GHSA-qcqv-38jg-2r43"}],"summary":"Pageflow vulnerable to insecure direct object reference in membership update endpoint"}