CVE-2026-125365

DollarDollar through 4.4 contains a missing authorization vulnerability in add expense() that allows authenticated users to modify other users' account balances by supplying foreign account id values. Attackers can submit sequential account id, destination account id, and group id values to /add expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.