CVE-2026-110772 — Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharin…
Published: 2026-10-14 · CVSS: 5.3 · CVSS 4.0
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7