Authorization Bypass in SplitPro Affects User Data Retrieval

CVE-2026-122317

What is CVE-2026-122317?

SplitPro versions up to 2.1.6 have a significant authorization bypass vulnerability that permits authenticated users to access sensitive account information. By supplying arbitrary user ID values to the user.getUserDetails method, an attacker can iterate through user IDs to collect confidential details such as email addresses, names, avatars, currency, banking IDs, and open-banking identifiers. This vulnerability poses a serious risk to user privacy and data security, enabling unauthorized data exposure.

References