CVE-2023-38872

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-28 · updated 2026-06-17
Weakness: CWE-639

Description

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

Affected products

Economizzer: 0.9-beta1, april_2023

References

https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872
https://github.com/gugoan/economizzer
https://www.economizzer.org
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872
https://github.com/gugoan/economizzer
https://www.economizzer.org

Get alerted when CVE-2023-38872 or the next vulnerability affects your stack