[BUG] User can add money to himself #47

New issue

Open

opened 2026-08-03 17:45:56 +00:00 by PoweredDeveloper · 0 comments

PoweredDeveloper commented

2026-08-03 17:45:56 +00:00

Owner

Describe the bug
Self-service money printing — POST /users/me/balance — routes.py:93-107 lets the caller add an arbitrary Decimal (negative values included, no bounds) to their own balance.

Solution
Remove that endpoint (not needed)

Checklist

I have searched for existing issues (including closed ones)
I can reproduce the issue on a fresh installation or latest version

**Describe the bug** Self-service money printing — POST /users/me/balance — routes.py:93-107 lets the caller add an arbitrary Decimal (negative values included, no bounds) to their own balance. **Solution** Remove that endpoint (not needed) **Checklist** - [x] I have searched for existing issues (including closed ones) - [x] I can reproduce the issue on a fresh installation or latest version

PoweredDeveloper added this to the Sprint 1 milestone

2026-08-03 17:45:56 +00:00

PoweredDeveloper added the

security

bug

backend

labels

2026-08-03 17:45:56 +00:00

PoweredDeveloper self-assigned this

2026-08-03 17:45:56 +00:00

PoweredDeveloper added this to the Backend (Core) project

2026-08-03 17:45:56 +00:00