CVE-2026-122317

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
oss-apps	SplitPro	<= 2.1.6

References

Timeline

Published: Nov 5, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1223187.7Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks whe CVE-2026-1223197.5Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy eng CVE-2026-122326.1The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int str CVE-2026-1223207.7Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namesp CVE-2026-1223219.1Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the i CVE-2026-1223227.5Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exha CVE-2026-1223237.5Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust m CVE-2026-1223243.1SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by suppl CVE-2026-1223253.1fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that a CVE-2026-1223265.3Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauth CVE-2026-1223274.3Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data CVE-2026-1223287.8SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law o