CVE-2026-23844: Whisper Money Auth Bypass Vulnerability

CVE-2026-23844 Overview

CVE-2026-23844 is an Insecure Direct Object Reference (IDOR) vulnerability in Whisper Money, a personal finance application. Versions prior to 0.1.5 contain a flaw that allows authenticated users to update or create account balances in other users' bank accounts, effectively bypassing authorization controls.

Critical Impact

An authenticated attacker can manipulate financial data belonging to other users, potentially altering bank account balances and transaction records without proper authorization.

Affected Products

• Whisper Money versions prior to 0.1.5

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-23844 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23844

Vulnerability Analysis

This vulnerability falls under CWE-488 (Exposure of Data Element to Wrong Session), manifesting as an Insecure Direct Object Reference (IDOR) issue in the Whisper Money application. The flaw exists in the request validation layer of the Laravel-based application, specifically in the BulkUpdateTransactionsRequest and StoreAccountBalanceRequest form request classes.

The application fails to properly validate that the authenticated user has ownership or authorization to modify the requested resource. When a user submits a request to update transactions or store account balances, the application does not verify that the target account belongs to the requesting user, allowing unauthorized cross-account modifications.

Root Cause

The root cause is insufficient authorization validation in the form request classes. The application accepts user-supplied account identifiers without validating that the authenticated user has permission to modify those accounts. This is a classic IDOR vulnerability where object references (account IDs) are directly used without proper access control checks.

Attack Vector

The attack is network-based and requires low-privileged access (an authenticated user account). An attacker with a valid user account can craft requests that reference other users' account identifiers, allowing them to:

1. Modify existing transaction records in other users' accounts
2. Create new account balance entries for accounts they don't own
3. Potentially manipulate financial records for malicious purposes

The following code shows the security patch that addresses this vulnerability by adding proper validation rules:

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;

class BulkUpdateTransactionsRequest extends FormRequest
{

Source: GitHub Commit Update

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;

class StoreAccountBalanceRequest extends FormRequest
{

Source: GitHub Commit Update

The fix introduces Laravel's Rule validation class, which enables the implementation of ownership validation rules that ensure users can only access resources they are authorized to modify.

Detection Methods for CVE-2026-23844

Indicators of Compromise

• Unusual cross-account modification patterns in application logs
• API requests containing account IDs that don't match the authenticated user's owned accounts
• Audit logs showing account balance changes initiated by users who don't own those accounts

Detection Strategies

• Implement application-level logging to track all account modification requests and their associated user sessions
• Monitor for anomalous patterns where users attempt to access or modify resources outside their ownership scope
• Review web application firewall (WAF) logs for requests containing manipulated object identifiers

Monitoring Recommendations

• Enable detailed request logging in the Whisper Money application to capture account ID parameters in all modification requests
• Configure alerting for any account balance modifications where the requesting user ID doesn't match the account owner
• Implement audit trails for all financial data modifications with user attribution

How to Mitigate CVE-2026-23844

Immediate Actions Required

• Upgrade Whisper Money to version 0.1.5 or later immediately
• Review application logs to identify any potential exploitation that may have occurred prior to patching
• Audit account balance records for any unauthorized modifications

Patch Information

Version 0.1.5 of Whisper Money addresses this vulnerability by implementing proper authorization checks in the form request validation layer. The fix can be reviewed in GitHub Pull Request #60 and the specific commit is available at GitHub Commit 80117c3. Additional details are available in the GitHub Security Advisory GHSA-c4g3-wpxr-2m74.

Workarounds

• If immediate upgrade is not possible, implement additional authorization middleware to validate resource ownership before processing modification requests
• Restrict application access to trusted users only until the patch can be applied
• Consider implementing rate limiting on account modification endpoints to reduce potential exploitation impact

# Update Whisper Money to patched version
composer update whisper-money/whisper-money
# Or install specific version
composer require whisper-money/whisper-money:^0.1.5