{"action":"Upgrade grumpydictator/firefly-iii to 6.5.1 or later.","affected":[{"fixed":"6.5.1","introduced":"6.4.23"}],"component":"grumpydictator/firefly-iii","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["6.5.1"],"ghsa_id":"GHSA-5q8v-j673-m5v4","id":"tcs_01M5KEWANTHTW4268XG1YXA5VX","modified_at":"2026-03-07T02:16:37.443496Z","published_at":"2026-03-07T02:10:45Z","references":["https://osv.dev/vulnerability/GHSA-5q8v-j673-m5v4","https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-5q8v-j673-m5v4","https://github.com/firefly-iii/firefly-iii"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5q8v-j673-m5v4","url":"https://osv.dev/vulnerability/GHSA-5q8v-j673-m5v4"}],"summary":"Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)"}