CVE-2026-125365

Description

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/harung1993/dollardollar/issues/125 ↗
• https://github.com/harung1993/dollardollar ↗
• https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298 ↗
• https://www.vulncheck.com/advisories/dollardollar-through-4.4-missing-authorization-in-add-expense-balance-tampering ↗