GitHub Advisoryadvisory · Packagist

GHSA-gg2f-r4jh-vpmh TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

HIGH Published 2025-03-18 Modified 2025-03-26 Official page ↗
Aliases
CVE-2024-44313
Ecosystem
Packagist
Packages
tastyigniter/tastyigniter
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2025-03-26

Affected packages

• Packagist tastyigniter/tastyigniter: < 4.0.0 → fixed in 4.0.0

Description

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.

Related

Alias · CVE (1)

  • CVE-2024-44313 TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References