Authorization bypass in SplitPro exposes other users' expenses
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
SplitPro through 2.1.6 from oss-apps contains an authorization bypass (CWE-639) in expense.getExpenseDetails. An authenticated user who obtains an expense UUID, such as from a removed former participant, can read other users' expenses, including notes, recurrence schedules and user details of participants and group members.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The sources list no fixed version for SplitPro.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Timeline
- 2026-11-05 Threatist record created from CVE-2026-122324
- 2026-11-05 Alias added: GHSA-2fpp-f9vq-796f
References
More oss-apps vulnerabilities
- TI-2026-85468 Authorization bypass in SplitPro exposes other users' details CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-122324 · CVE Program
- CVE-2026-122324 · NVD
- FIRST EPSS
- GHSA-2fpp-f9vq-796f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences