Threats affecting pkg:github/SplitPro

SplitPro versions up to 2.1.6 have an authorization bypass vulnerability that allows authenticated users to access other users' expense details by manipulating expenseId values. This can expose sensitive information such as expense notes, recurrence schedules, and participant data.

SplitPro versions up to 2.1.6 have an authorization bypass vulnerability that allows authenticated users to access details of any account by providing arbitrary userId values. This flaw enables attackers to sequentially enumerate user IDs and harvest sensitive information including email, name, avatar, currency, bankingId, and open-banking identifiers such as obapiProviderId.