Authorization Bypass in SplitPro Allows User Data Exposure

Executive Summary

CVE-2026-122317 is an authorization bypass flaw in SplitPro through version 2.1.6. It allows authenticated users to retrieve any account's details by supplying arbitrary userId values to the user.getUserDetails function. Attackers can iterate sequential user IDs to harvest sensitive data like emails, names, avatars, currency preferences, and banking identifiers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for repeated requests to user.getUserDetails or expense.getExpenseDetails endpoints with sequential or arbitrary userId/expenseId values. Check for unusual data exposure patterns in user profiles or expense records accessed by non-owners.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to access unauthorized user data, including email addresses, banking IDs, and personal details. They can enumerate all user accounts by cycling through sequential IDs, leading to potential privacy breaches, phishing attacks, or misuse of exposed financial identifiers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data minimization and access control principles by exposing personal data without authorization. It may also breach HIPAA if protected health information is involved, as unauthorized access to user details could compromise confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SplitPro to the latest version beyond 2.1.6. Implement strict object-level authorization checks in user.getUserDetails and expense.getExpenseDetails to verify ownership or participation. Disable sequential user ID enumeration by using non-sequential or UUID-based identifiers.

Useful 0 Not Useful 0