CVE-2026-125365
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.