{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122317", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:25:07.316Z", "datePublished": "2026-11-05T15:11:42.836Z", "dateUpdated": "2026-11-05T15:11:42.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:42.836Z"}, "datePublic": "2026-10-30T00:00:00.000Z", "title": "SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query", "descriptions": [{"lang": "en", "value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "affected": [{"vendor": "oss-apps", "product": "SplitPro", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.1.6", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/oss-apps/split-pro", "repo": "https://github.com/oss-apps/split-pro"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/oss-apps/split-pro/issues/786", "tags": ["issue-tracking"]}, {"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212", "tags": ["technical-description"]}, {"url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/oss-apps/split-pro", "tags": ["product"]}, {"name": "VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/oss-apps/split-pro", "product": "SplitPro", "repo": "https://github.com/oss-apps/split-pro", "vendor": "oss-apps", "versions": [{"lessThanOrEqual": "2.1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers."}], "id": "CVE-2026-122317", "lastModified": "2026-11-05T16:17:44.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T16:17:44.963", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/oss-apps/split-pro"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oss-apps/split-pro/issues/786"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "split-pro: split-pro: Information disclosure via authorization bypass in user.getUserDetails", "id": "2567447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567447"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in split-pro. An authorization bypass vulnerability allows an authenticated remote attacker to access sensitive user account details by submitting arbitrary user identifiers to the user.getUserDetails function. An attacker can systematically query sequential IDs to harvest other users' personal and financial data, including names, email addresses, and open-banking identifiers."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122317", "public_date": "2026-11-05T15:11:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122317\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122317\nhttps://github.com/oss-apps/split-pro\nhttps://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51\nhttps://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212\nhttps://github.com/oss-apps/split-pro/issues/786\nhttps://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure\nhttps://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query"], "statement": "This vulnerability is assessed as Moderate impact for Red Hat deployments because it requires authenticated network access and only compromises data confidentiality without allowing system alteration or privilege elevation. The underlying issue allows logged-in users to view profile and banking metadata across tenant accounts due to insufficient authorization controls. SplitPro is not packaged or distributed within the Red Hat product portfolio, resulting in no direct impact on supported Red Hat platforms.", "threat_severity": "Moderate"}

{"created": "2026-11-05T17:15:07.763046+00:00", "updated": "2026-11-05T17:15:07.763052+00:00", "vendors": []}