Threats tagged 'ghsa-qc4q-6gxc-hfjr'

SplitPro versions up to 2.1.6 have an authorization bypass vulnerability allowing authenticated users to access details of any account by manipulating userId parameters. This flaw enables attackers to sequentially enumerate user IDs and harvest sensitive information including email, name, avatar, currency, bankingId, and open-banking identifiers such as obapiProviderId.