Medium severity4.3NVD Advisory· Published Nov 5, 2026
CVE-2026-122317
CVE-2026-122317
Description
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prismanvd
- github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.tsnvd
- github.com/oss-apps/split-pro/issues/786nvd
- hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosurenvd
- www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-querynvd
News mentions
0No linked articles in our index yet.