CVE-2026-122324 json
SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
published 4d ago modified 9h ago also EUVD-2026-117532
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
Patch / fix
Is CVE-2026-122324 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9h ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- hackmd.io https://hackmd.io/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- oss-apps SplitPro
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49
patch
-
hackmd.io
/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure
exploit
-
github.com
/oss-apps/split-pro/issues/786
issue-tracking
-
github.com
/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/expense.ts#L351-L424
technical-description
-
hackmd.io
/@hieund/splitpro-trpc-idor-user-expense-disclosure
third-party-advisory
-
github.com
/oss-apps/split-pro
product
-
vulncheck.com
/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails
third-party-advisory
Sources
- CVE List CVE-2026-122324
- NVD CVE-2026-122324
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.