Threats tagged 'ghsa-2fpp-f9vq-796f'

SplitPro versions through 2.1.6 have an authorization bypass vulnerability that allows authenticated users to access other users' expense details by manipulating expenseId parameters. This can expose sensitive information such as expense notes, recurrence schedules, and participant data. The vulnerability has a low severity rating and no known exploits in the wild.