CVE-2026-41644

HIGH

monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh

Title source: cna
STIX 2.1

Description

monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issue HTTP GET requests to arbitrary URLs supplied by the caller, with the response body from non-200 upstream responses reflected back in the API error message. This issue has been patched in version 1.12.5.

References (4)

Core 4

Scores

CVSS v3 7.1
EPSS 0.0033
EPSS Percentile 24.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-209 CWE-770 CWE-918
Status published
Products (2)
monetr/monetr < 1.12.5 (2 CPE variants)
monetr/monetr 0 - 1.12.5Go
Published May 07, 2026
Tracked Since May 07, 2026