PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110772 we-promise CVE debrief

A missing authorization vulnerability exists in Sure 0.7.0 through 0.7.6-alpha.6, allowing authenticated members with read_only or no share to modify other members' transaction data via bulk updates. This vulnerability can lead to potential unauthorized modification of transaction data and corruption of budgets and reports. Defenders should assess exposure and prioritize remediation efforts, focusing on restricting unauthorized bulk update access and verifying account sharing permissions.

Vendor
we-promise
Product
sure
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for Sure instances, particularly those with shared accounts or read_only access, should assess exposure and prioritize remediation efforts. They should focus on restricting unauthorized bulk update access, verifying account sharing permissions, and monitoring for suspicious activity. This includes reviewing compensating controls for exposed systems and tracking exceptions and retest remediated assets.

Why it matters

This vulnerability allows authenticated members to bypass account sharing permissions and modify other members' transaction data, potentially corrupting budgets and reports. Defenders should prioritize verifying and remediating this vulnerability in Sure instances, focusing on restricting unauthorized bulk update access.

  • Potential unauthorized modification of transaction data
  • Corruption of budgets and reports
  • Verification of account sharing permissions and bulk update access
  • Prioritization of remediation efforts

Technical summary

The vulnerability exists in Transactions::BulkUpdatesController#create, allowing authenticated members to bypass account sharing permissions and modify other members' transaction data. This can lead to potential unauthorized modification of transaction data and corruption of budgets and reports. The vulnerability can be remediated by restricting unauthorized bulk update access and verifying account sharing permissions. Defenders should prioritize verifying and remediating this vulnerability in Sure instances, focusing on restricting unauthorized bulk update access.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Sure instances, focusing on restricting unauthorized bulk update access.

Recommended defensive actions

  • Verify and remediate the vulnerability in Sure instances
  • Restrict unauthorized bulk update access
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Sure 0.7.0 through 0.7.6-alpha.6. The NVD entry is currently UNCHANGED. The vulnerability exists in Transactions::BulkUpdatesController#create, allowing authenticated members to bypass account sharing permissions and modify other members' transaction data. Defenders should verify and remediate this vulnerability in Sure instances, focusing on restricting unauthorized bulk update access and monitoring for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110772 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110772

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110772 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110772

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110772.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/we-promise/sure/issues/2099

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/we-promise-sure-transactions-bulk-update-missing-authz

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/we-promise/sure/blob/a3bb5d991f9b96e335e9212b1a6324289577f143/app/controllers/transactions/bulk_updates_controller.rb

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/we-promise/sure

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/sure-0.7.0-through-0.7.6-alpha.6-missing-authorization-via-transaction-bulk-update

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.