{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-11146 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-11146 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-11146 is a medium-severity missing authorization vulnerability in i3 Verticals TrueFiling, published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-11146 and fix it if it is affected.\n\nWhat it is: CVE-2024-11146 is a medium-severity missing authorization vulnerability in i3 Verticals TrueFiling, published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-11146 in the wild and no public exploit code.\n\nAffected product: i3 Verticals TrueFiling. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-11146/ (Markdown: https://insights.sbomify.com/CVE-2024-11146/index.md)","id":"CVE-2024-11146","markdown":"https://insights.sbomify.com/CVE-2024-11146/index.md","name":"CVE-2024-11146","record":{"aliases":["GHSA-h44w-w4w4-cjc2"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Legal filing system","requires_auth":"none","summary":"Authenticated users can manipulate client-controlled identifiers to access and modify case information they should not have access to.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"cisa-cg","cpe":[{"product":"truefiling","vendor":"i3verticals"}],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/V:D/RE:L","version":"4.0"},"cwes":[{"id":"CWE-807","name":"Reliance on Untrusted Inputs in a Security Decision"},{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"description":"TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"TrueFiling authorization bypass via user-controlled keys","id":"CVE-2024-11146","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2024"},"n_packages":0,"n_references":2,"next":{"headline":"ECOVACS lawnmowers and vacuums deterministic root password","id":"CVE-2024-11147"},"packages":[],"prev":{"headline":"Easy Folder Listing Pro deserialization vulnerability","id":"CVE-2024-11145"},"products":["TrueFiling"],"published":"2025-01-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-21","vendors":["i3 Verticals"]},"summary":"Authenticated users can manipulate client-controlled identifiers to access and modify case information they should not have access to.","url":"https://insights.sbomify.com/CVE-2024-11146/"}