CVE-2026-61614
MediumCVSS 5.9Summary
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
Risk Assessment
Exposure of API credentials in logs and browser history may allow attackers to intercept them and gain unauthorized access to the API, potentially leading to data breaches.
Recommendation
Immediately upgrade SolidInvoice to version 3.0.1 or later. Also purge any logs containing tokens and advise users to rotate API keys.
Other vulnerabilities in SolidInvoice
See all- CVE-2026-61688Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
- CVE-2026-61686High
SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.
- CVE-2026-61608Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.
- CVE-2026-46622High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table.
- CVE-2026-46489High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepted any file type without validation, allowing SVG files with embedded JavaScript to be uploaded.
Original NVD description (English source)
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.