DOLLARDOLLAR · CVE-2026-125365 · Other
NO FIX YET · SEE WHAT TO DO
DollarDollar through version 4.4 has a missing authorization check in its add_expense() function. An authenticated user can send foreign account_id and group_id values to /add_expense to change other users' account balances and add expenses to groups they do not belong to.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run a self-hosted DollarDollar instance with more than one user account are exposed, because any logged-in user can post to the add_expense endpoint with another user's IDs. Single-user installs and instances that do not expose the app to other users are less exposed. The sources do not say whether a default configuration is affected.
Not affected if no-untrusted-accounts, single-user-instance
Who cares dollardollar, self-hosted
/add_expense route or an add_expense() function in the DollarDollar code, and check whether it verifies that the account and group belong to the logged-in user.4.4.DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.