SplitPro vulnerabilities
CVEs whose affected-version data names the SplitPro package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-122317Medium· 4.3SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer…
▾ Sunlitoss-apps · SplitProEPSS 0.23%via CVEORG
CVE-2026-122324Low· 3.1SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUI…
▾ Sunlitoss-apps · SplitProEPSS 0.22%via CVEORG