Threats affecting pkg:github/harung1993/dollardollar

DollarDollar versions up to 4.4 have an authorization bypass vulnerability in the add_expense() function. Authenticated users can manipulate other users' account balances by submitting arbitrary account_id, destination_account_id, and group_id values. This allows tampering with balances and injecting expenses into groups where the attacker is not authorized as the payer.