CVE-2026-23844
EUVD-2026-328619.01.2026, 21:15
Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| whisper.money | whisper_money | 𝑥 < 0.1.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-488 - Exposure of Data Element to Wrong SessionThe product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.