Search
Find a vulnerability
Search criteria
4 vulnerabilities by oss-apps
CVE-2026-122324 (GCVE-0-2026-122324)
Vulnerability from nvd – Published: 2026-11-05 15:11 – Updated: 2026-11-09 17:07
VLAI
EPSS
VEX
Title
SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
Summary
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:07 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/oss-apps/split-pro/issues/786 | issue-tracking |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://github.com/oss-apps/split-pro/commit/1a0f… | patch |
| https://hackmd.io/@hieund/splitpro-trpc-idor-user… | third-party-advisory |
| https://github.com/oss-apps/split-pro | product |
| https://www.vulncheck.com/advisories/splitpro-thr… | third-party-advisory |
| https://hackmd.io/@hieund/cve-2026-122317-122324-… | exploit |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122324",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:07:05.319817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:07:36.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/oss-apps/split-pro",
"product": "SplitPro",
"repo": "https://github.com/oss-apps/split-pro",
"vendor": "oss-apps",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Wiktor Krokosz"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users\u0027 expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:43.503Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/oss-apps/split-pro/issues/786"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/expense.ts#L351-L424"
},
{
"tags": [
"patch"
],
"url": "https://github.com/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure"
},
{
"tags": [
"product"
],
"url": "https://github.com/oss-apps/split-pro"
},
{
"name": "VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails"
}
],
"title": "SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122324",
"datePublished": "2026-11-05T15:11:43.503Z",
"dateReserved": "2026-11-04T23:26:08.935Z",
"dateUpdated": "2026-11-09T17:07:36.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122317 (GCVE-0-2026-122317)
Vulnerability from nvd – Published: 2026-11-05 15:11 – Updated: 2026-11-09 22:06
VLAI
EPSS
VEX
Title
SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
Summary
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:05 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/oss-apps/split-pro/issues/786 | issue-tracking |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://hackmd.io/@hieund/splitpro-trpc-idor-user… | third-party-advisory |
| https://github.com/oss-apps/split-pro | product |
| https://www.vulncheck.com/advisories/splitpro-thr… | third-party-advisory |
| https://hackmd.io/@hieund/cve-2026-122317-122324-… | exploit |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122317",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:05:40.640370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:06:06.027Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/oss-apps/split-pro",
"product": "SplitPro",
"repo": "https://github.com/oss-apps/split-pro",
"vendor": "oss-apps",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account\u0027s details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user\u0027s email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:42.836Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/oss-apps/split-pro/issues/786"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure"
},
{
"tags": [
"product"
],
"url": "https://github.com/oss-apps/split-pro"
},
{
"name": "VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query"
}
],
"title": "SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122317",
"datePublished": "2026-11-05T15:11:42.836Z",
"dateReserved": "2026-11-04T23:25:07.316Z",
"dateUpdated": "2026-11-09T22:06:06.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122324 (GCVE-0-2026-122324)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:11 – Updated: 2026-11-09 17:07
VLAI
EPSS
VEX
Title
SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
Summary
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:07 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/oss-apps/split-pro/issues/786 | issue-tracking |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://github.com/oss-apps/split-pro/commit/1a0f… | patch |
| https://hackmd.io/@hieund/splitpro-trpc-idor-user… | third-party-advisory |
| https://github.com/oss-apps/split-pro | product |
| https://www.vulncheck.com/advisories/splitpro-thr… | third-party-advisory |
| https://hackmd.io/@hieund/cve-2026-122317-122324-… | exploit |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122324",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:07:05.319817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:07:36.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/oss-apps/split-pro",
"product": "SplitPro",
"repo": "https://github.com/oss-apps/split-pro",
"vendor": "oss-apps",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Wiktor Krokosz"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users\u0027 expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:43.503Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/oss-apps/split-pro/issues/786"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/expense.ts#L351-L424"
},
{
"tags": [
"patch"
],
"url": "https://github.com/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure"
},
{
"tags": [
"product"
],
"url": "https://github.com/oss-apps/split-pro"
},
{
"name": "VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails"
}
],
"title": "SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122324",
"datePublished": "2026-11-05T15:11:43.503Z",
"dateReserved": "2026-11-04T23:26:08.935Z",
"dateUpdated": "2026-11-09T17:07:36.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122317 (GCVE-0-2026-122317)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:11 – Updated: 2026-11-09 22:06
VLAI
EPSS
VEX
Title
SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
Summary
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:05 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/oss-apps/split-pro/issues/786 | issue-tracking |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://github.com/oss-apps/split-pro/blob/v2.1.6… | technical-description |
| https://hackmd.io/@hieund/splitpro-trpc-idor-user… | third-party-advisory |
| https://github.com/oss-apps/split-pro | product |
| https://www.vulncheck.com/advisories/splitpro-thr… | third-party-advisory |
| https://hackmd.io/@hieund/cve-2026-122317-122324-… | exploit |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122317",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:05:40.640370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:06:06.027Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieund/cve-2026-122317-122324-splitpro-trpc-idor-user-expense-disclosure"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/oss-apps/split-pro",
"product": "SplitPro",
"repo": "https://github.com/oss-apps/split-pro",
"vendor": "oss-apps",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account\u0027s details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user\u0027s email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:42.836Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/oss-apps/split-pro/issues/786"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure"
},
{
"tags": [
"product"
],
"url": "https://github.com/oss-apps/split-pro"
},
{
"name": "VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query"
}
],
"title": "SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122317",
"datePublished": "2026-11-05T15:11:42.836Z",
"dateReserved": "2026-11-04T23:25:07.316Z",
"dateUpdated": "2026-11-09T22:06:06.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}