In monetr, a budgeting application, a transaction integrity flaw permits an authenticated tenant user to soft‑delete imported non‑manual transactions through the update (PUT) endpoint, even though the standard DELETE route explicitly blocks such deletions. By setting the deleted flag on these protected records, a user can hide them from normal views, thereby compromising the integrity of the application's transaction data.

The issue impacts all monetr installations running versions prior to 1.12.3. Any tenant user with authentication privileges can exploit the flaw by using the transaction update API to delete protected transactions.

The vulnerability is assigned a CVSS score of 5.7, indicating moderate severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user leveraging the PUT endpoint; this inference is drawn from the description of the update-based deletion capability. Because authorization is required, the flaw is not publicly exploitable without tenant credentials, but it undermines internal data integrity controls and warrants prompt mitigation.