CVE-2026-41644

High

Published: 07/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In the monetr application, prior to version 1.12.5, there was a server-side request forgery (SSRF) vulnerability in the Lunch Flow integration. This allowed any authenticated user on a self-hosted instance to send HTTP GET requests to arbitrary URLs, resulting in the response body from non-200 upstream responses being reflected back in the API error messages.

Risk Assessment

This vulnerability could lead to the disclosure of sensitive information or allow attackers to manipulate data within the system. Organizations should be aware of the risks associated with unauthorized access to internal resources.

Recommendation

It is recommended to update the monetr application to version 1.12.5 or later to mitigate this vulnerability. Additionally, conducting a security audit to assess potential threats is advisable.

Other vulnerabilities in monetr

CVE-2026-39901Medium
monetr before 1.12.3 has a transaction integrity flaw allowing authenticated users to soft-delete synced non-manual transactions via the transaction update endpoint, bypassing the normal DELETE block. This hides protected transactions from normal views.

Original NVD description (English source)

monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issue HTTP GET requests to arbitrary URLs supplied by the caller, with the response body from non-200 upstream responses reflected back in the API error message. This issue has been patched in version 1.12.5.