Threats tagged 'ghsa-cffh-jr3f-2pq9'

DollarDollar versions through 4.4 have a missing authorization vulnerability in the add_expense() function. Authenticated users can exploit this flaw to modify other users' account balances by submitting foreign account_id values. By providing sequential account_id, destination_account_id, and group_id parameters to the /add_expense endpoint, attackers can tamper with balances and inject expenses into groups they do not belong to with an arbitrary payer.