---
id: "CVE-2026-122317"
kind: "vulnerability"
aliases: ["CVE-2026-122317"]
title: "SplitPro: authenticated users can read any account's details and banking IDs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "splitpro", "trpc"]
not_affected_if: ["newer-version", "unauthenticated-only"]
published_at: "2026-11-05T16:17:44+00:00"
first_seen_at: "2026-11-05T16:40:01+00:00"
updated_at: "2026-11-05T16:41:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122317", "first_seen_at": "2026-11-05T16:40:01+00:00"}]
exploit_sources: []
---

# SplitPro: authenticated users can read any account's details and banking IDs

SplitPro, a bill-splitting app, lets any logged-in user fetch another account's details by passing an arbitrary userId to user.getUserDetails. An attacker can step through sequential integer IDs to collect every user's email, name, avatar, currency, and open-banking identifiers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your SplitPro version is `2.1.6` or older.
- Look at the user.getUserDetails handler and confirm it compares the requested userId against the logged-in session user.

## Timeline

- 2026-11-05T16:40:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122317

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query

## From the sources

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_