> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raleyapps.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Raley Purchase Orders security release — June 2022

> Security release notes for Raley Purchase Orders v1.0.12-AC, June 2022: vulnerabilities identified, fixes shipped, affected components, and upgrade guidance.

## Summary

In May 2022, RaleyApps enrolled in the **Bugcrowd** security testing program. During testing, two vulnerabilities were identified in Raley Purchase Orders version 1.0.11-AC. Both were resolved in **version 1.0.12-AC**, released June 30, 2022.

## Vulnerabilities Fixed

### 1. Unauthorized Admin Access

**Issue:** A JSM customer user was able to access administrative configuration pages that should have been restricted.

**Root cause:** Insufficient authorization checks on the affected page.

**Fix:** Additional permission verification controls were implemented.

**Customer impact:** No confirmed exploitation based on access log review.

***

### 2. Missing Authorization on API Endpoints

**Issue:** Multiple backend REST API endpoints lacked proper authorization verification, allowing unauthorized users to potentially access, modify, or delete:

* Company data
* Approval tiers
* Department-related data
* Jira configuration settings

**Root cause:** Incorrect authorization controls on the application backend.

**Fix:** Applied simultaneously with vulnerability #1 in version 1.0.12-AC.

**Customer impact:** No evidence of exploitation in any customer installation.

## Action Required

**Update to version 1.0.12-AC or later.** If you are running an older version, please update through the Atlassian Marketplace.

## Questions?

* **Email:** [support@raleyapps.com](mailto:support@raleyapps.com)
* **Service Portal:** [inversionpoint.atlassian.net/servicedesk](https://inversionpoint.atlassian.net/servicedesk/customer/portal/3)

***

## Explore Other RaleyApps

<CardGroup cols={2}>
  <Card title="Raley Emails Notifications" icon="envelope" href="/apps/raley-emails-notifications">
    Send customized emails and Slack notifications from Jira and JSM.
  </Card>

  <Card title="Raley Intake Forms" icon="file-lines" href="/apps/raley-intake-forms">
    Create powerful intake forms directly inside Jira and JSM.
  </Card>

  <Card title="Raley Bookman" icon="calendar-check" href="/apps/raley-bookman">
    Asset booking management inside the JSM portal.
  </Card>

  <Card title="Raley Favorites" icon="star" href="/apps/raley-favorites">
    Save and quickly access your most important Jira issues.
  </Card>
</CardGroup>

[Browse all RaleyApps on the Atlassian Marketplace →](https://marketplace.atlassian.com/vendors/1212475/inversion-point-llc?utm_source=mintify\&utm_medium=productdocs\&utm_campaign=footage\&utm_term=\&utm_content=)