---
id: CVE-2026-122317
title: SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
summary: >-
  SplitPro through 2.1.6 contains an authorization bypass vulnerability that
  allows authenticated users to retrieve any account's details by supplying
  arbitrary userId values to user.getUserDetails. Attackers can iterate
  sequential integer…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: oss-apps
product: SplitPro
affected:
  - SplitPro <= 2.1.6
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:11:42.836Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122317'
references:
  - url: 'https://github.com/oss-apps/split-pro/issues/786'
  - url: >-
      https://github.com/oss-apps/split-pro/blob/v2.1.6/src/server/api/routers/user.ts#L202-L212
  - url: >-
      https://github.com/oss-apps/split-pro/blob/v2.1.6/prisma/schema.prisma#L41-L51
  - url: 'https://hackmd.io/@hieund/splitpro-trpc-idor-user-expense-disclosure'
  - url: 'https://github.com/oss-apps/split-pro'
  - url: >-
      https://www.vulncheck.com/advisories/splitpro-through-2.1.6-authorization-bypass-via-user-getuserdetails-trpc-query
    label: >-
      VulnCheck Advisory: SplitPro through 2.1.6 Authorization Bypass via
      user.getUserDetails tRPC Query
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.893Z'
epss: 0.00234
epssPercentile: 0.14366
---

## Overview

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.

## Affected

- `SplitPro <= 2.1.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.