CVE-2026-39901 monetr: Protected Transactions Deletable via PUT
Authenticated users can bypass deletion protections to soft-delete synced transactions via the update endpoint, hiding records from views.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-39901?
CVE-2026-39901 is a medium-severity missing authorization vulnerability in monetr, published on 8 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal DELETE path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views. This vulnerability is fixed in 1.12.3.
Weakness: CWE-285
Which versions are affected by CVE-2026-39901?
3 open source packages ship an affected version, including github.com/monetr/monetr.
| Package | Affected | Fixed in |
|---|---|---|
github.com/monetr/monetr Go | All versions | 1.12.3 |
github.com/monetr/monetr Go | All versions | 1.12.3 |
github.com/monetr/monetr Go | All versions | 1.12.3 |
How do I fix CVE-2026-39901?
Upgrade github.com/monetr/monetr to 1.12.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-39901 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39901 exists.
Sources
Also known as GHSA-hqxq-hwqf-wg83, GO-2026-5434.