CVE-2026-110772: Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated family member whose sharing permission is read_only or no share can exploit it. The attacker must be able to submit requests to the transaction bulk-update endpoint and supply entry IDs for another member's transactions.
What data can be changed through the vulnerable bulk update?
The attacker can modify other members' transaction dates, names, notes, categories, merchants, and tags. This can corrupt budget and reporting data, although the provided information does not indicate confidentiality or availability impact.
Are users with limited account-sharing permissions protected?
No. The vulnerability specifically allows family members with read_only or no share permissions to bypass the intended account-sharing authorization checks.