{"id":"CVE-2026-125365","kind":"vulnerability","aliases":["CVE-2026-125365"],"related":[],"title":"DollarDollar: expense endpoint lets logged-in users change other users' balances","description":"DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.","summary":"DollarDollar through version 4.4 has a missing authorization check in its add_expense() function. An authenticated user can send foreign account_id and group_id values to /add_expense to change other users' account balances and add expenses to groups they do not belong to.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DollarDollar","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dollardollar","other","self-hosted"],"not_affected_if":["no-untrusted-accounts","single-user-instance"],"how_to_check":"- Look for an `/add_expense` route or an `add_expense()` function in the DollarDollar code, and check whether it verifies that the account and group belong to the logged-in user.\n- Check the installed DollarDollar version and compare it with `4.4`.","fix":"- DollarDollar: unknown (the sources do not name a fixed version).","status":"open","published_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:16+00:00","updated_at":"2026-11-10T00:30:16+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:16Z","model":"claude-haiku-5-5","output":{"fix":"- DollarDollar: unknown (the sources do not name a fixed version).","reach":"network","title":"DollarDollar: expense endpoint lets logged-in users change other users' balances","impact":"medium","summary":"DollarDollar through version 4.4 has a missing authorization check in its add_expense() function. An authenticated user can send foreign account_id and group_id values to /add_expense to change other users' account balances and add expenses to groups they do not belong to.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dollardollar","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker changes other users' balances and injects expenses into foreign groups.","analyst_note":"Confirm the fixed version and whether the flaw is in the default configuration, using the NVD entry and the VulnCheck advisory.","how_to_check":"- Look for an `/add_expense` route or an `add_expense()` function in the DollarDollar code, and check whether it verifies that the account and group belong to the logged-in user.\n- Check the installed DollarDollar version and compare it with `4.4`.","plain_action":"","product_name":"DollarDollar","needs_analyst":true,"not_affected_if":["single-user-instance","no-untrusted-accounts"],"who_is_affected":"Teams that run a self-hosted DollarDollar instance with more than one user account are exposed, because any logged-in user can post to the add_expense endpoint with another user's IDs. Single-user installs and instances that do not expose the app to other users are less exposed. The sources do not say whether a default configuration is affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4596,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125365':15A,18A '-2026':14A,17A '/add_expense':52B,109C '4.4':28B,70C 'account':45B,57B,87C,92C,99C,102C 'add':36B,60B,77C 'allow':80C 'arbitrari':122C 'attack':95C 'authent':40B,81C 'author':32B,74C 'balanc':12A,58B,88C,113C 'belong':67B 'chang':9A,54B 'check':33B 'contain':71C 'cve':13A,16A 'destin':101C 'dollardollar':1A,19A,20B,25B,68C 'endpoint':3A 'expens':2A,37B,61B,78C,116C 'foreign':44B,91C,118C 'function':38B 'group':48B,63B,105C,119C 'host':24B 'id':46B,49B,93C,100C,103C,106C 'inject':115C 'let':4A 'log':6A 'logged-in':5A 'miss':31B,73C 'modifi':84C 'payer':123C 'self':23B 'self-host':22B 'send':43B 'sequenti':98C 'submit':97C 'suppli':90C 'tamper':111C 'user':8A,11A,41B,56B,82C,86C 'valu':50B,94C,107C 'version':27B 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted DollarDollar instance with more than one user account are exposed, because any logged-in user can post to the add_expense endpoint with another user's IDs. Single-user installs and instances that do not expose the app to other users are less exposed. The sources do not say whether a default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["dollardollar"],"ptokens":["dollardollar"],"labels":["dollardollar","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-125365':15A,18A '-2026':14A,17A 'balanc':12A 'chang':9A 'cve':13A,16A 'dollardollar':1A,19A 'endpoint':3A 'expens':2A 'let':4A 'log':6A 'logged-in':5A 'user':8A,11A","search_b":"'/add_expense':52B '4.4':28B 'account':45B,57B 'add':36B,60B 'authent':40B 'author':32B 'balanc':58B 'belong':67B 'chang':54B 'check':33B 'dollardollar':20B,25B 'expens':37B,61B 'foreign':44B 'function':38B 'group':48B,63B 'host':24B 'id':46B,49B 'miss':31B 'self':23B 'self-host':22B 'send':43B 'user':41B,56B 'valu':50B 'version':27B","search_c":"'/add_expense':109C '4.4':70C 'account':87C,92C,99C,102C 'add':77C 'allow':80C 'arbitrari':122C 'attack':95C 'authent':81C 'author':74C 'balanc':88C,113C 'contain':71C 'destin':101C 'dollardollar':68C 'expens':78C,116C 'foreign':91C,118C 'group':105C,119C 'id':93C,100C,103C,106C 'inject':115C 'miss':73C 'modifi':84C 'payer':123C 'sequenti':98C 'submit':97C 'suppli':90C 'tamper':111C 'user':82C,86C 'valu':94C,107C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125365","severity":null,"published_at":"2026-11-10T00:17:08+00:00","modified_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111510,"url":"https://www.vulncheck.com/advisories/dollardollar-through-4.4-missing-authorization-in-add-expense-balance-tampering","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}