CVE-2026-125365

6.5 MEDIUMpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-639

Public exploit & PoC references

https://github.com/harung1993/dollardollar
https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298
https://github.com/harung1993/dollardollar/issues/125

All references

https://github.com/harung1993/dollardollar
https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298
https://github.com/harung1993/dollardollar/issues/125
https://www.vulncheck.com/advisories/dollardollar-through-4.4-missing-authorization-in-add-expense-balance-tampering

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2024-34323
MEDIUMCVE-2025-71420PoC
MEDIUMCVE-2026-100142
UNSCOREDCVE-2026-100177PoC
HIGHCVE-2026-100268
MEDIUMCVE-2026-100272
HIGHCVE-2026-100364PoC
HIGHCVE-2026-100514

Related by shared AI tags and CWE weakness class. Browse the full archive.