CVE-2026-122317

The software SplitPro (versions up to and including 2.1.6 ) is vulnerable to an authorization bypass within the user.getUserDetails tRPC query. The root cause is an IDOR (CWE-639) where the application fails to properly validate ownership, allowing authenticated users to retrieve account details ...