CVE-2026-125365

MEDIUM 6.5

DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.

CWE	CWE-639
Vendor	harung1993
Product	dollardollar
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for harung1993 dollardollar

Be the first to know when new medium vulnerabilities affecting harung1993 dollardollar are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

harung1993 / dollardollar

0 ≤ 4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/harung1993/dollardollar/issues/125 github.com: https://github.com/harung1993/dollardollar github.com: https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298 vulncheck.com: https://www.vulncheck.com/advisories/dollardollar-through-4.4-missing-authorization-in-add-expense-balance-tampering

Credits

George Chen