Missing Authorization Vulnerability (CVE-2026-50007) in Budget File Management with POC

Vulnerability Overview Title: Shared users can perform owner-only file management actions CVE ID: CVE-2026-50007 Severity: High Reporter: MatissJanis Published: Within the last month Description: This vulnerability allows shared users ( ) to perform actions restricted to file owners on budget files. In local testing, a non-owner shared user was able to invoke file management endpoints that should be restricted to high-privilege users, successfully marking another user's hosted budget file as deleted. This authorization flaw also applies to other administrative operations, such as key resets and key creation. Root Cause: The issue stems from overly broad authorization reuse in the server-side file management process. Specifically, incorrectly treats standard shared access ( ) as sufficient to perform actions that should be restricted to the file owner or administrator. Impact Scope Affected Versions: = 26.7.0 Confirmed Impacts: Deletion of hosted budget files Reset of synchronization status Rewriting of file key metadata Execution of other owner-only administrative actions Remediation Fixed Version: >= 26.7.0 POC Code Impact This is a privilege escalation / missing authorization issue affecting hosted budget file management. Users with only shared access permissions can perform actions that should be restricted to the file owner or administrator. Related Endpoints POST /delete-user-file POST /reset-user-file POST /user-create-key Conclusion This vulnerability allows lower-privilege users to perform destructive or administrative actions against other users' hosted budget files.

Goal Reached Thanks to every supporter — we hit 100%!

Missing Authorization Vulnerability (CVE-2026-50007) in Budget File Management with POC

More from this source