AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

CursorGHSA-c43p-6fv2-6gr2

IDOR in Usage API Leading to Unauthorized Data Exposure

Cursor

Published Jun 19, 2025

Medium4.3
Fix: upgrade to 2025-06-17 or later
GitHub advisory

Summary

An Insecure Direct Object Reference (IDOR) vulnerability existed in the /api/dashboard/get-monthly-invoice endpoint. This flaw allows any authenticated team member to retrieve invoice and usage data for the entire team, regardless of their authorization level.

Impact

This flaw exposed private usage and cost data of all team members regardless of role within the team.

Remediation

The endpoint has been restricted as of 2025-06-17 to only administrators for users on teams.

Affected versions

PackageAffectedFixed in
Cursor API
Product
< 2025-06-172025-06-17
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-639

More Cursor advisories

All Cursor
Medium 6.4Aug 1, 2025Bypassing allow list to execute an arbitrary commandCVE-2025-54131fixed in 1.3Medium 4.4Aug 1, 2025Arbitrary Image Fetch in Mermaid Diagram ToolCVE-2025-54132fixed in 1.3MediumAug 1, 2025MCP Install Deeplink Did Not Show Arguments on User-DialogCVE-2025-54133fixed in 1.3High 7.2Aug 1, 2025Modification of MCP Server Definitions Bypasses Manual Re-approvalCVE-2025-54136fixed in 1.3Medium 4.3Jun 19, 2025IDOR in Usage Events API Lets Users Access Teammates' Activity DataGHSA-rjmc-526x-8653fixed in 2025-06-17Medium 5.9Jun 11, 2025Potential Information Leakage using JSON schema in Cursor AgentCVE-2025-49150fixed in 0.51.0