8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41644

CVE-2026-41644: monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh

monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issue HTTP GET requests to arbitrary URLs supplied by the caller, with the response body from non-200 upstream responses reflected back in the API error message. This issue has been patched in version 1.12.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41644

CVE-2026-41644:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/monetr/monetr	go	< 1.12.5	1.12.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a server-side request forgery (SSRF) in the Lunch Flow integration of monetr, stemming from insufficient validation of user-provided URLs. The analysis of the patch commit c260caa3c573a4a396ec2d264c7641a5d958385b reveals several key areas that were changed to mitigate the vulnerability.

Link Creation (postLunchFlowLink): The primary entry point was the POST /api/lunch_flow/link endpoint. The patch added a validation rule to parsePostLunchFlowLinkRequest, which is called by postLunchFlowLink, to ensure the provided URL is in a new, configurable allowlist. This prevents the initial injection of a malicious URL.
Request Execution (doRequest): The function that makes the actual HTTP request, doRequest, was modified to use io.LimitReader. This mitigates a secondary denial-of-service (DoS) vulnerability where an attacker could cause the server to exhaust memory by reading an infinitely large response. The function's behavior of reflecting the response body in error messages, which enabled data exfiltration, was implicitly mitigated by preventing requests to unauthorized URLs in the first place.
Client Instantiation (NewLunchFlowClient): The patch added an explicit check in NewLunchFlowClient to validate the API URL against the allowlist. This is a critical defense-in-depth measure, as it protects all callers of this function.
Recurring Triggers (postLunchFlowLinkBankAccountsRefresh, syncLunchFlow.Run): The SSRF could be re-triggered after initial link creation through the refresh endpoint or the background sync job. Both functionalities were patched to pass the necessary configuration to NewLunchFlowClient, ensuring that even if a malicious URL was somehow stored in the database, no requests would be made to it.

The identified functions represent the complete chain of the vulnerability, from the initial user input to the outbound request and the handling of its response.

Vulnerable functions

github.com/monetr/monetr/server/controller.(*Controller).postLunchFlowLink

server/controller/lunch_flow.go

This function handles the `POST /api/lunch_flow/link` endpoint. Before the patch, it did not validate the user-provided `lunchFlowURL` against an allowlist, allowing an attacker to create a link with an arbitrary URL, which the server would then request. This is the initial entry point for the SSRF vulnerability.

github.com/monetr/monetr/server/datasources/lunch_flow.(*lunchFlowClient).doRequest

server/datasources/lunch_flow/client.go

This function makes the outbound HTTP request. It was vulnerable in two ways: it read the response body without a size limit, leading to a potential Denial of Service (DoS), and it reflected the response body in the error message for non-200 responses, which is the mechanism for data exfiltration in the SSRF.

github.com/monetr/monetr/server/datasources/lunch_flow.NewLunchFlowClient

server/datasources/lunch_flow/client.go

This function creates the HTTP client for communicating with the Lunch Flow API. Before the patch, it would create a client for any URL, allowing other parts of the application (like the refresh and sync functionalities) to make requests to malicious endpoints.

github.com/monetr/monetr/server/controller.(*Controller).postLunchFlowLinkBankAccountsRefresh

server/controller/lunch_flow.go

This function handles refreshing an existing Lunch Flow link. It was vulnerable because it would instantiate a new client using the `ApiUrl` stored in the database, which could be a malicious URL set during the initial link creation, thus re-triggering the SSRF.

github.com/monetr/monetr/server/datasources/lunch_flow/lunch_flow_jobs.(*syncLunchFlow).Run

server/datasources/lunch_flow/lunch_flow_jobs/sync_lunch_flow.go

This is the background job for syncing Lunch Flow data. It was vulnerable because it would create a client using the potentially malicious URL stored for the link, triggering the SSRF periodically.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.