{"cve":"CVE-2026-39901","nvd":{"published":"2026-04-08T22:16:22.010","modified":"2026-07-24T21:10:00.143","status":"Deferred","description":"monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. This vulnerability is fixed in 1.12.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","score":5.7},"cwes":["CWE-285"],"references":["https://github.com/monetr/monetr/security/advisories/GHSA-hqxq-hwqf-wg83"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-39901","score":0.00292,"percentile":0.21843,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-hqxq-hwqf-wg83","url":"https://osv.dev/vulnerability/GHSA-hqxq-hwqf-wg83","summary":"monetr: Protected Transactions Deletable via PUT","modified":"2026-07-21T14:53:20Z","packages":[{"ecosystem":"Go","name":"github.com/monetr/monetr","purl":"pkg:golang/github.com/monetr/monetr","ranges":["<1.12.3"],"fixed":["1.12.3"]}]},{"id":"GO-2026-5434","url":"https://osv.dev/vulnerability/GO-2026-5434","summary":"monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr","modified":"2026-06-25T23:01:09.777025771Z","packages":[{"ecosystem":"Go","name":"github.com/monetr/monetr","purl":"pkg:golang/github.com/monetr/monetr","ranges":["<1.12.3"],"fixed":["1.12.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}