CVE-2026-122324— SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails

Quick assessment

Affected

oss-apps SplitPro

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SplitPro 2.1.6 及以下版本存在授权绕过漏洞，允许已认证用户通过向接口提供任意值来读取其他用户的费用记录。攻击者若获取到费用 UUID（例如来自已移除的前参与者），即可检索费用备注、重复计划，以及参与者和小组成员的完整用户数据。

CVSS 3.1 · Low Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1036 · Masquerading T1201 · Password Policy Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails

Source: CVE Program / CVE List V5

Vulnerability Description

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
oss-apps	SplitPro	0 ~ 2.1.6	-

II. Public POCs for CVE-2026-122324

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-122324

请登录查看更多情报信息。

Other References for CVE-2026-122324 (6)

https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure third-party-advisory
https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/expense.ts#L351-L424 technical-description
https://github.com/oss-apps/split-pro/issues/786 issue-tracking
https://github.com/oss-apps/split-pro product
https://github.com/oss-apps/split-pro/commit/1a0f8f498098e4b90bd73e7b710860e1ea98cc49 patch
https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-expense-getexpensedetails third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-122324

IV. Related Vulnerabilities

Same product: SplitPro

CVE-2026-122317
SplitPro through 2.1.6 Authorization Bypass via user.getUser

Same vendor: oss-apps

CVE-2026-122317
SplitPro through 2.1.6 Authorization Bypass via user.getUser

Same weakness: CWE-639