CVE-2026-122324
SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
| CWE | CWE-639 |
| Vendor | oss-apps |
| Product | splitpro |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for oss-apps splitpro
Be the first to know when new low vulnerabilities affecting oss-apps splitpro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
oss-apps / SplitPro
0 ≤ 2.1.6
References
github.com: https://github.com/oss-apps/split-pro/issues/786 github.com: https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/expense.ts#L351-L424 github.com: https://github.com/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49 hackmd.io: https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure github.com: https://github.com/oss-apps/split-pro vulncheck.com: https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails
Credits
hieuPenguinnn Wiktor Krokosz