Sure CVE-2026-110772

Requires an authenticated account inside a Sure instance that uses account sharing with multiple family members; the attacker's account need only have read_only or no share privilege (PR:L). The attacker must be able to reach the bulk-updates endpoint and supply entry_ids belonging to other members - the missing authorization check is the enabling condition, present by default in affected versions where sharing is used. Limiting factors: single-user instances and instances without shared accounts are not exploitable, the attacker needs valid authenticated credentials in the same family, and impact is confined to integrity of transaction metadata (no data disclosure, no service disruption). No end-user interaction from the victim is required.

This is a medium-severity authorization flaw (CWE-862) whose signals are internally consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation by an already-authenticated low-privilege user, with impact limited to integrity of one component (VI:L) and no confidentiality or availability loss (VC:N/VA:N) - matching the description, where read_only or no-share family members can alter other members' transaction metadata but cannot read protected data or crash the service. No EPSS score was provided, the CVE is not on CISA KEV, and no proof-of-concept exploit flag is present in the input, so there is no public exploit identified at time of analysis. The PR:L requirement is the single biggest risk-limiter: an attacker already needs a legitimate account inside the same family/shared instance, making this an insider/abuse-of-trust problem rather than an internet-facing mass-exploitation threat. The low score and absence of exploitation signals are congruent - this is a genuine broken-access-control bug worth patching for multi-user deployments, but it is not an emergency-priority issue. Note one metadata conflict: the single tag 'Authentication Bypass' contradicts the description and CWE-862, which describe an authorization (not authentication) bypass by an already-authenticated user.

In a shared Sure instance, a family member who was granted read-only access (or no sharing at all) crafts a request to the Transactions::BulkUpdatesController#create endpoint supplying entry_ids that belong to other members. Because the controller fails to verify the caller is authorized for those entries, the attacker silently rewrites the dates, names, notes, categories, merchants, and tags of other members' transactions, corrupting their budgets and reports. No public exploit is identified in the provided data, but the attack requires only a standard authenticated request with low complexity.