Authorization Bypass in SplitPro Affects User Data Access

CVE-2026-122324

What is CVE-2026-122324?

SplitPro versions through 2.1.6 are susceptible to an authorization bypass vulnerability, which allows authenticated users to gain unauthorized access to sensitive information. By manipulating the expenseId parameter in the expense.getExpenseDetails API, attackers can read the expense details of other users, including notes and schedules related to expenses involving participants whose UUIDs they have exploited. This flaw potentially exposes user data, posing a significant risk to individual privacy and financial security.

References