DollarDollar Missing Authorization Allows Balance Tampering

Executive Summary

CVE-2026-125365 is a missing authorization vulnerability in DollarDollar through version 4.4. It exists in the /add_expense endpoint where authenticated users can manipulate account balances and inject expenses into other users' accounts or groups by supplying foreign account_id and group_id values without proper ownership checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized transactions in the /add_expense endpoint logs. Look for POST requests with account_id, group_id, or paid_by fields not matching the authenticated user. Monitor for sequential or unusual ID values in financial records.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to tamper with financial balances by guessing sequential account IDs, inflating or draining other users' balances. They can also insert fake expense records into any group and attribute them to arbitrary users as the payer, creating false debts or hiding existing ones.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could significantly impact compliance with GDPR and HIPAA due to unauthorized access to financial data. GDPR requires strict data protection and user consent for financial transactions, while HIPAA mandates safeguards for sensitive health-related financial records. The flaw allows attackers to modify account balances and inject false expenses, potentially violating integrity and confidentiality requirements of both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update DollarDollar to the latest version beyond 4.4. Implement strict ownership validation by comparing account_id and group_id with the current_user.id before processing transactions. Add input validation to reject foreign account references.

Useful 0 Not Useful 0