CVE-2026-61608
MediumCVSS 6.8Summary
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.
Risk Assessment
Indefinite validity of invitations may allow an attacker to use an intercepted invitation to gain unauthorized access to company resources, potentially leading to security breaches.
Recommendation
Immediately upgrade SolidInvoice to version 3.0.1 or later. Also invalidate all existing invitations and consider implementing an invitation expiry policy.
Other vulnerabilities in SolidInvoice
See all- CVE-2026-61688Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
- CVE-2026-61686High
SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.
- CVE-2026-61614Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
- CVE-2026-46622High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table.
- CVE-2026-46489High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepted any file type without validation, allowing SVG files with embedded JavaScript to be uploaded.
Original NVD description (English source)
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.