PT-2026-31460 · Monetr · Monetr

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39901

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions monetr versions prior to 1.12.3

Description A transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. The issue affects the transaction update path for synced transactions associated with non-manual links. The vulnerability is a server-side authorization and integrity flaw caused by trusting a client-supplied full transaction object and failing to protect sensitive server-managed fields from modification. The affected API endpoint is the transaction update endpoint. The vulnerable parameter is deletedAt.

Recommendations Versions prior to 1.12.3 should be updated to version 1.12.3 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-39901

GHSA-HQXQ-HWQF-WG83

Affected Products

Monetr

References · 7

• https://osv.dev/vulnerability/GHSA-hqxq-hwqf-wg83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39901 · Security Note
• https://github.com/monetr/monetr · Note
• https://github.com/monetr/monetr/security/advisories/GHSA-hqxq-hwqf-wg83 · Note
• https://github.com/monetr/monetr/releases/tag/v1.12.3 · Note
• https://twitter.com/CVEnew/status/2041999826271842540 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042000948151668867 · Twitter Post