https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 14:59:34 +0000 https://db.gcve.eu/vuln/cve-2026-110772 <p><strong>Affected:</strong> we-promise sure</p> <p>Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members&#39; transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.</p> <p><strong>Affected:</strong> we-promise sure</p> <p>Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members&#39; transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.</p> https://db.gcve.eu/vuln/cve-2026-110772