{"id":"CVE-2026-122317","kind":"vulnerability","aliases":["CVE-2026-122317"],"related":[],"title":"SplitPro: authenticated users can read any account's details and banking IDs","description":"SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.","summary":"SplitPro, a bill-splitting app, lets any logged-in user fetch another account's details by passing an arbitrary userId to user.getUserDetails. An attacker can step through sequential integer IDs to collect every user's email, name, avatar, currency, and open-banking identifiers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","splitpro","trpc"],"not_affected_if":["newer-version","unauthenticated-only"],"how_to_check":"- Check whether your SplitPro version is `2.1.6` or older.\n- Look at the user.getUserDetails handler and confirm it compares the requested userId against the logged-in session user.","fix":null,"status":"open","published_at":"2026-11-05T16:17:44+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:46+00:00","updated_at":"2026-11-05T16:41:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T16:41:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SplitPro: authenticated users can read any account's details and banking IDs","impact":"medium","summary":"SplitPro, a bill-splitting app, lets any logged-in user fetch another account's details by passing an arbitrary userId to user.getUserDetails. An attacker can step through sequential integer IDs to collect every user's email, name, avatar, currency, and open-banking identifiers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["splitpro","self-hosted","trpc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads every user's email, name and banking identifiers","analyst_note":"Find the fixed SplitPro version and the patch for user.getUserDetails; check the vulncheck advisory for the fix.","how_to_check":"- Check whether your SplitPro version is `2.1.6` or older.\n- Look at the user.getUserDetails handler and confirm it compares the requested userId against the logged-in session user.\n- unknown whether the sources list any other check.","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only","newer-version"],"who_is_affected":"Teams that self-host SplitPro 2.1.6 or earlier and let users log in. Any authenticated user can read other accounts' records by changing the userId. Instances where only the operator uses the app, or that run a newer build with an ownership check, are not exposed. The sources do not say which version fixes it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4272,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122317':15A,18A '-2026':14A,17A '2.1.6':73C 'account':7A,39B,86C 'allow':80C 'anoth':38B 'app':30B 'arbitrari':45B,91C 'attack':50B,96C 'authent':2A,81C 'author':76C 'avatar':64B,110C 'bank':11A,69B,118C 'bankingid':113C 'bill':28B 'bill-split':27B 'bypass':77C 'collect':58B 'contain':74C 'currenc':65B,111C 'cve':13A,16A 'detail':9A,41B,88C 'email':62B,108C 'everi':59B,105C 'fetch':37B 'harvest':104C 'host':22B 'id':12A,56B,102C 'identifi':70B,119C 'integ':55B,100C 'iter':98C 'let':31B 'log':34B 'logged-in':33B 'name':63B,109C 'obapiproviderid':115C 'open':68B,117C 'open-bank':67B,116C 'packag':19B 'pass':43B 'read':5A 'retriev':84C 'self':21B 'self-host':20B 'sequenti':54B,99C 'split':29B 'splitpro':1A,23B,25B,71C 'step':52B 'suppli':90C 'trpc':24B 'user':3A,36B,60B,82C,101C,106C 'user.getuserdetails':48B,95C 'userid':46B,92C 'valu':93C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host SplitPro 2.1.6 or earlier and let users log in. Any authenticated user can read other accounts' records by changing the userId. Instances where only the operator uses the app, or that run a newer build with an ownership check, are not exposed. The sources do not say which version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","splitpro","trpc"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122317","severity":null,"published_at":"2026-11-05T16:17:44+00:00","modified_at":"2026-11-05T16:17:44+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":77624,"url":"https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}