The vulnerability stemmed from three key issues:
- In InvoiceController::previewAction, the original route accepted user-controlled template ID and customer ID parameters with insufficient permission checks (only 'view_invoice'), allowing parameter manipulation to access unauthorized data.
- CustomerRepository allowed customer ID injection in queries through form parameters without validation of the user's right to access those customers.
- CustomerVoter lacked specific team membership checks for customer access until the 'access' permission was implemented. The patch added multiple security annotations (@Security), team checks in the voter, and parameter validation controls to properly enforce access restrictions.
Miggo AI