CVE-2026-110772

Deferred Deferred - Pending Action

Missing Authorization in Sure 0.7.0-0.7.6-alpha.6 Allows Transaction Tampering

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110772

EUVD

EUVD-2026-101572

Affected Vendors & Products

Vendor	Product	Version / Range
we-promise	sure	0.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in the Sure personal finance application versions 0.7.0 through 0.7.6-alpha.6. It allows authenticated family members with read-only or no sharing permissions to bypass account sharing restrictions and modify other members' transaction details such as dates, names, notes, categories, merchants, and tags. The issue occurs in the Transactions::BulkUpdatesController#create function, which fails to enforce proper sharing permissions during bulk transaction updates.

Detection Guidance

Check Sure application logs for bulk transaction update requests from read_only or unauthorized users. Inspect network traffic for POST requests to /transactions/bulk_updates with entry IDs not owned by the requesting user. Review database changes for unexpected modifications to transaction fields like dates, names, or categories by non-owners.

Impact Analysis

This vulnerability can allow unauthorized users to alter financial records, corrupt budgets, and distort reports by changing transaction details like dates, categories, or merchants. It may also suppress bank-sync corrections, leading to inaccurate financial tracking and potential financial losses or privacy breaches.

Compliance Impact

This vulnerability could lead to unauthorized modifications of financial data, which may violate GDPR's data integrity principles (Article 5) and HIPAA's integrity requirements for protected health information. Unauthorized changes to transaction details could also breach GDPR's data accuracy obligations and HIPAA's access controls.

Mitigation Strategies

Update Sure to the latest patched version. Temporarily disable bulk transaction updates if no patch is available. Implement network-level restrictions to block unauthorized bulk update requests. Audit all transaction modifications and restore corrupted data from backups.

Hi! I’m here to help you understand CVE-2026-110772. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70