The vulnerability is an authorization bypass in SplitPro that lets an authenticated user call user.getUserDetails with any userId. By supplying arbitrary numeric IDs, the attacker can access private data such as email, name, avatar, currency, banking identifiers, and obapiProviderId. This flaw arises from improper authorization checks (CWE‑639) and leads to the exposure of sensitive user information. The exploitation does not result in code execution or application compromise, but it does compromise confidentiality of user profiles.

SplitPro releases through version 2.1.6 are affected. The vulnerability resides in the user router implementation, which is part of the public API for logged‑in users. Users running any release prior to 2.1.7 would be vulnerable unless mitigated.

The CVSS base score of 5.3 indicates a medium impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need valid authentication and can iterate over sequential user ids to enumerate all accounts, which is feasible for a determined insider or compromised account. Because the flaw requires legitimate credentials, the risk is limited to users with access, but once exploited it can expose a large amount of personal information. Administrators should consider the vulnerability a moderate threat pending an official fix.