we-promise CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM we-promise CVE published 2026-10-14

CVE-2026-110772

A missing authorization vulnerability exists in Sure 0.7.0 through 0.7.6-alpha.6, allowing authenticated members with read_only or no share to modify other members' transaction data via bulk updates. This vulnerability can lead to potential unauthorized modification of transaction data and corruption of budgets and reports. Defenders should assess exposure and prioritize remediation efforts, focusing on r [truncated]