CVE-2026-122317

EUVD-2026-117531
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/oss-apps/split-pro
https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51
https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212
https://github.com/oss-apps/split-pro/issues/786
https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure
https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query