A broken access control vulnerability could have led to dangerous follow-on attacks for users of the money-management app.