Whisper Money’s sync/balances endpoint suffers from an insecure direct object reference that allows an authenticated user to modify balances in other users’ bank accounts, potentially leading to unauthorized financial changes. The flaw corresponds to CWE‑639 and CWE‑488. An attacker can manipulate account balances without privilege escalation, resulting in monetary loss or incorrect account state.

The vulnerability affects the Whisper Money personal finance application before version 0.1.5. Users running any pre‑0.1.5 release are susceptible. The issue has been addressed in version 0.1.5 and later.

The CVSS score of 4.9 indicates low to medium severity, and the EPSS score is below 1%, suggesting a low probability of observed exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote user sending crafted requests to the sync/balances endpoint after authenticating, taking advantage of missing ownership checks. Even though exploitation is unlikely, the impact on financial data can be significant.