{"cve":"CVE-2020-15120","nvd":{"published":"2020-07-27T18:15:13.983","modified":"2026-06-17T02:56:05.490","status":"Modified","description":"In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":4.9},"cwes":["CWE-863"],"references":["https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471","https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9","https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471","https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9"],"products":["ihatemoney:i_hate_money"],"source":"nvd","synced_at":"2026-10-19T21:06:22.076270124+00:00"},"epss":{"cve":"CVE-2020-15120","score":0.01029,"percentile":0.63683,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-67j9-c52g-w2q9","url":"https://osv.dev/vulnerability/GHSA-67j9-c52g-w2q9","summary":"Authorization Bypass in I hate money","modified":"2026-09-10T03:48:48.309575321Z","packages":[{"ecosystem":"PyPI","name":"ihatemoney","purl":"pkg:pypi/ihatemoney","ranges":["<4.1.5"],"fixed":["4.1.5"]}]},{"id":"PYSEC-2020-264","url":"https://osv.dev/vulnerability/PYSEC-2020-264","summary":"","modified":"2023-11-08T04:02:29.917680Z","packages":[{"ecosystem":"PyPI","name":"ihatemoney","purl":"pkg:pypi/ihatemoney","ranges":["<4.1.5"],"fixed":["4.1.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}