CVE-2026-125365: DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering
DollarDollar through 4.4 contains a missing authorization vulnerability in addexpense() that allows authenticated users to modify other users' account balances by supplying foreign accountid values. Attackers can submit sequential accountid, destinationaccountid, and groupid values to /addexpense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated. The vulnerable endpoint permits authenticated users to supply account_id, destination_account_id, and group_id values belonging to other users or groups.
What access or interaction is required for exploitation?
Exploitation is network-reachable and requires low privileges, with no user interaction required. An attacker can submit requests to /add_expense using foreign identifiers, including sequential values.
What is the practical impact?
An attacker can alter other users' account balances and inject expenses into groups they do not control. The attacker can also assign an arbitrary payer to those injected expenses.
Which versions are affected?
DollarDollar through version 4.4 is affected.