{"action":"Upgrade ihatemoney to 4.1.5 or later.","affected":[{"fixed":"4.1.5","introduced":"0"}],"component":"ihatemoney","cve_ids":["CVE-2020-15120"],"ecosystem":"PyPI","epss":0.01029,"exploited":false,"fixed_versions":["4.1.5"],"ghsa_id":"GHSA-67j9-c52g-w2q9","id":"tcs_01M5KGA4919KK59BQ8J149819Y","modified_at":"2023-11-08T04:02:29.917680Z","published_at":"2020-07-27T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-264","https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9","https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-264","url":"https://osv.dev/vulnerability/PYSEC-2020-264"}],"summary":"In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be fur"}