CVE-2026-122317— SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query

Quick assessment

Affected

oss-apps SplitPro

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SplitPro 2.1.6 及更早版本存在授权绕过漏洞，允许已认证用户通过向接口提供任意值，检索任意账户的详细信息。攻击者可遍历连续的整数用户 ID，从而批量收集所有用户的电子邮件、姓名、头像、货币类型、以及等开放银行标识符。

CVSS 4.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1213 · Data from Information Repositories T1086

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query

Source: CVE Program / CVE List V5

Vulnerability Description

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
oss-apps	SplitPro	0 ~ 2.1.6	-

II. Public POCs for CVE-2026-122317

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-122317

请登录查看更多情报信息。

Other References for CVE-2026-122317 (6)

https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure third-party-advisory
https://github.com/oss-apps/split-pro/issues/786 issue-tracking
https://github.com/oss-apps/split-pro product
https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212 technical-description
https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51 technical-description
https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-122317

IV. Related Vulnerabilities

Same product: SplitPro

CVE-2026-122324
SplitPro through 2.1.6 Authorization Bypass via expense.getE

Same vendor: oss-apps

CVE-2026-122324
SplitPro through 2.1.6 Authorization Bypass via expense.getE

Same weakness: CWE-639