A missing authorization check in the transaction bulk update endpoint allows authenticated users to manipulate transaction records of other members. The flaw permits changing dates, names, notes, categories, merchants, and tags for any transaction specified by ID, corrupting budgets and reports. This results in unauthorised alteration of financial data, potentially compromising confidentiality and integrity of shared account information.

The issue affects the Sure web application versions 0.7.0 up to 0.7.6-alpha.6 released by we‑promise. Any deployment of these versions that enables family members to use the bulk update feature is vulnerable.

The CVSS score of 5.3 indicates moderate severity. Exploit requires successful authentication to the application and possession of family member privileges, but does not require elevated system privileges. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation at present appears low. Nonetheless, unauthenticated external attackers cannot reach the vulnerable path; an attacker inside a shared account can perform the misuse without additional access.