CVE-2020-15120

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.

• CWE-863
• CWE-863

• https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471Patch, Third Party Advisory
• https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9Third Party Advisory
• https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471Patch, Third Party Advisory
• https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9Third Party Advisory

Published

Jul 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7
• CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
• CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
• CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
• CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
• CVE-2020-1512An information disclosure vulnerability exists when the Wind…7.8
• CVE-2020-15121In radare2 before version 4.5.0, malformed PDB file names in…9.6
• CVE-2020-15123In codecov (npm package) before version 3.7.1 the upload met…9.3
• CVE-2020-15124In Goobi Viewer Core before version 4.8.3, a path traversal …6.5
• CVE-2020-15125In auth0 (npm package) versions before 2.27.1, a DenyList of…7.7
• CVE-2020-15126In parser-server from version 3.5.0 and before 4.3.0, an aut…6.5
• CVE-2020-15127In Contour ( Ingress controller for Kubernetes) before versi…7.5