Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-41644monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh
High 8.3
In plain English
A high-severity resource allocation without limits in monetr from monetr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issue HTTP GET requests to arbitrary URLs supplied by the caller, with the response body from non-200 upstream responses reflected back in the API error message. This issue has been patched in version 1.12.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/monetr/monetr | 1.12.5 | GHSA-29v9-frvh-c426 |
| Go | github.com/monetr/monetr | 1.12.5 | GO-2026-4966 |
Affected products (as reported)
Weakness: CWE-209, CWE-770, CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N
References
- https://github.com/monetr/monetr/security/advisories/GHSA-29v9-frvh-c426 x_refsource_CONFIRM
- https://github.com/monetr/monetr/pull/3122 x_refsource_MISC
- https://github.com/monetr/monetr/commit/c260caa3c573a4a396ec2d264c7641a5d958385b x_refsource_MISC
- https://github.com/monetr/monetr/releases/tag/v1.12.5 x_refsource_MISC