CVE-2026-110772

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read only or no share can submit arbitrary entry ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.