---
id: "CVE-2026-122324"
kind: "vulnerability"
aliases: ["CVE-2026-122324"]
title: "SplitPro: authenticated users can read other users' expenses by ID"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "splitpro"]
not_affected_if: ["no-external-accounts", "single-user-instance"]
published_at: "2026-11-05T16:17:45+00:00"
first_seen_at: "2026-11-05T16:40:02+00:00"
updated_at: "2026-11-05T16:41:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122324", "first_seen_at": "2026-11-05T16:40:02+00:00"}]
exploit_sources: []
---

# SplitPro: authenticated users can read other users' expenses by ID

SplitPro through 2.1.6 lets any logged-in user fetch expense details for expenses they do not belong to by supplying an arbitrary expenseId. An attacker who has an expense UUID, such as a former group participant, can read expense notes, recurrence schedules, and full user records of participants and group members.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-05T16:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122324

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails
- [fix] Patch: github.com https://github.com/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49

## From the sources

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_