CVE-2026-122317 · Package
NO FIX YET
SplitPro, a bill-splitting app, lets any logged-in user fetch another account's details by passing an arbitrary userId to user.getUserDetails. An attacker can step through sequential integer IDs to collect every user's email, name, avatar, currency, and open-banking identifiers.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host SplitPro 2.1.6 or earlier and let users log in. Any authenticated user can read other accounts' records by changing the userId. Instances where only the operator uses the app, or that run a newer build with an ownership check, are not exposed. The sources do not say which version fixes it.
Not affected if newer-version, unauthenticated-only
Who cares self-hosted, splitpro, trpc
2.1.6 or older.No fix yet, per the sources.
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.