monetr, a budgeting application, contains a server‑side request forgery flaw in its Lunch Flow integration. When an authenticated user creates or refreshes a Lunch Flow link, the server accepts a URL parameter and issues an HTTP GET request to that URL. If the upstream service responds with a non‑200 status code, the server includes the response body in the API error message, exposing the body to the caller.

The vulnerability exists in all released versions of monetr prior to 1.12.5, inclusive of the monetr:monetr product line for self‑hosted deployments.

With a CVSS score of 8.3, this vulnerability is high‑severity. Exploitation requires an authenticated session on a self‑hosted instance, and the attacker can trigger it through the Lunch Flow link creation or refresh endpoint. The server then performs HTTP GET requests to any URL supplied by the attacker. Because the response body of non‑200 responses is returned in an API error message, the attacker can see the content of those responses. This could enable internal network reconnaissance or result in the disclosure of internal data, which is inferred from the description that the server can reach arbitrary URLs and that the response body is reflected back to the user. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog.