Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M
CVE-2026-39901monetr: Protected Transactions Deletable via PUT
Medium 5.7
In plain English
A medium-severity security flaw in monetr from monetr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. This vulnerability is fixed in 1.12.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/monetr/monetr | 1.12.3 | GHSA-hqxq-hwqf-wg83 |
| Go | github.com/monetr/monetr | 1.12.3 | GO-2026-5434 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/monetr/monetr/security/advisories/GHSA-hqxq-hwqf-wg83 x_refsource_CONFIRM