Grocy Information Disclosure Vulnerability

An information disclosure vulnerability exists in Grocy versions through 4.3.0. It allows remote attackers to access sensitive data by directly requesting pages that are not visible in the user interface, such as the calendar and recipes. This issue is a result of broken access control, where unauthorized users can bypass restrictions by accessing certain URLs or API endpoints directly.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, such as recipe details and calendar entries.

Reproduction

To reproduce this vulnerability, create a user with no permissions and log in. Then, directly access the calendar or recipe URLs, which will return data despite the lack of authorization for those functions.