CVE-2026-39901

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39901
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39901.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39901
Aliases
Downstream
Related
Published
2026-04-08T21:02:56.280Z
Modified
2026-07-31T18:31:29.775641698Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
monetr: Protected Transactions Deletable via PUT
Details

monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. This vulnerability is fixed in 1.12.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39901.json"
}
References

Affected packages

Git / github.com/monetr/monetr

Affected ranges

Type
GIT
Repo
https://github.com/monetr/monetr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0c7ce43bd5642cf528519c7c2975aff22d725508
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12.3"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.10.0
v0.10.1
v0.10.10
v0.10.11
v0.10.12
v0.10.13
v0.10.14
v0.10.15
v0.10.16
v0.10.17
v0.10.18
v0.10.19
v0.10.2
v0.10.20
v0.10.21
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.10.9
v0.11.0
v0.11.1
v0.11.10
v0.11.11
v0.11.12
v0.11.13
v0.11.14
v0.11.15
v0.11.16
v0.11.17
v0.11.18
v0.11.19
v0.11.2
v0.11.20
v0.11.21
v0.11.22
v0.11.23
v0.11.24
v0.11.25
v0.11.26
v0.11.27
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v0.11.9
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.13.0
v0.14.0
v0.14.1
v0.14.10
v0.14.2
v0.14.3
v0.14.4
v0.14.5
v0.14.6
v0.14.7
v0.14.8
v0.14.9
v0.15.0
v0.15.1
v0.15.10
v0.15.11
v0.15.12
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.15.6
v0.15.7
v0.15.8
v0.15.9
v0.16.0
v0.16.1
v0.16.10
v0.16.11
v0.16.12
v0.16.13
v0.16.2
v0.16.3
v0.16.4
v0.16.5
v0.16.6
v0.16.7
v0.16.8
v0.16.9
v0.17.0
v0.17.1
v0.17.10
v0.17.11
v0.17.12
v0.17.13
v0.17.14
v0.17.15
v0.17.16
v0.17.17
v0.17.18
v0.17.19
v0.17.2
v0.17.20
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.17.7
v0.17.8
v0.17.9
v0.18.0
v0.18.1
v0.18.10
v0.18.11
v0.18.12
v0.18.13
v0.18.14
v0.18.15
v0.18.16
v0.18.17
v0.18.18
v0.18.19
v0.18.2
v0.18.20
v0.18.21
v0.18.22
v0.18.23
v0.18.24
v0.18.25
v0.18.26
v0.18.27
v0.18.28
v0.18.29
v0.18.3
v0.18.30
v0.18.31
v0.18.32
v0.18.33
v0.18.34
v0.18.35
v0.18.36
v0.18.37
v0.18.38
v0.18.39
v0.18.4
v0.18.40
v0.18.41
v0.18.5
v0.18.6
v0.18.7
v0.18.8
v0.18.9
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.10
v0.6.11
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.16
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.10
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.10
v0.8.11
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.10
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.9.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39901.json"