SplitPro through version 2.1.6 includes a flaw that allows any authenticated user to retrieve expense details belonging to other users simply by submitting an arbitrary expenseId. The vulnerability arises from a missing authorization check on the expense.getExpenseDetails endpoint. An attacker who obtains a valid expense UUID – for example, from a former participant who was removed from the group – can read expense notes, recurrence schedules, and the entire list of participants and group members. The fault is classified as a CWE‑639 authorization bypass weakness. Because the privileged data is personal financial information, the violation constitutes a confidentiality breach.

Vendors: oss-apps. Product: SplitPro. The error affects all releases up through 2.1.6 inclusive. Users running any older or patch‑unfixed versions of SplitPro are potentially vulnerable until a fix is applied.

The vulnerability is rated low in the CVSS model (score of 2.3), which reflects a confined scope limited to authenticated users and does not involve code execution or denial of service. The EPSS score is not provided, and the vulnerability is currently not listed in the CISA KEV catalog. An attacker must first authenticate to SplitPro, then supply a valid or guessed expense UUID. If the attacker can learn or guess a UUID – obtainable from a former participant’s records – the endpoint will return full expense metadata. This gives an insider or compromised account a straightforward path to read sensitive data of other participants.