The vulnerability arises from a missing authorization check in the add_expense() endpoint of DollarDollar version 4.4. Authenticated users can supply arbitrary account_id, destination_account_id and group_id values to the /add_expense route, which allows them to alter other users’ account balances and inject expenses into foreign groups with an arbitrary payer. This flaw enables an attacker to modify the financial state of other accounts without permission, potentially leading to incorrect accounting or fraud. The weakness is classified as CWE‑639, Unauthorized Access.

The product affected is the DollarDollar web application, as provided by the vendor harung1993. The vulnerable version is 4.4; other versions are not listed as affected here.

The CVSS score of 7.1 classifies the issue as High severity. The EPSS score is not available, leaving the actual exploitation probability uncertain, but the risk remains significant because the flaw requires only authentication and occurs over the network via the /add_expense endpoint. The vulnerability is not listed in the CISA KEV catalog, so no known exploits are publicly tracked. Attackers would authenticate to the application and then submit crafted requests to tamper with balances—there is no need for additional privileges beyond normal user rights.