https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:06:44.897191+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-290517 EUVD-2026-290517 2026-10-07T01:06:44.942936+00:00 EUVD-2026-290517 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39901 fkie_cve-2026-39901 2026-10-07T01:06:44.942973+00:00

monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. This vulnerability is fixed in 1.12.3.

 https://cve.radiocsirt.org/vuln/ghsa-hqxq-hwqf-wg83 GHSA-hqxq-hwqf-wg83 — monetr: Protected Transactions Deletable via PUT 2026-10-07T01:06:44.943007+00:00

Affected: Go: github.com/monetr/monetr

### Summary A transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal `DELETE` path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views.

### Details The issue affects the transaction update path for synced transactions associated with non-manual links. The intended policy is clearly enforced in the `DELETE` handler: deletion of synced transactions for non-manual links is rejected with an error indicating that such transactions cannot be deleted.

However, the `PUT` update path still accepts a client-controlled full `Transaction` object and persists fields that should be server-managed, including `deletedAt`. The update logic appears to restrict only selected fields, which leaves `deletedAt` attacker-controllable.

Verified behavior on the same synced transaction showed:

- `DELETE` was denied with the expected protection error for non-manual links - `PUT` with a user-supplied `deletedAt` value succeeded and returned `200 OK` - a subsequent transaction list no longer showed the transaction - `GET` by transaction ID still returned the record with `deletedAt` populated

This demonstrates a policy bypass: although the server explicitly defines synced transactions on non-manual links as non-deletable throu…