CVE-2026-61688
MediumCVSS 6.5Summary
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
Risk Assessment
The vulnerability allows disclosure of sensitive data (API request history) to other users within the company, potentially leading to confidentiality breaches and further attacks.
Recommendation
Immediately upgrade SolidInvoice to version 3.0.1 or later, which contains the fix. Also restrict user privileges to the minimum necessary.
Other vulnerabilities in SolidInvoice
See all- CVE-2026-61686High
SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.
- CVE-2026-61614Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
- CVE-2026-61608Medium
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.
- CVE-2026-46622High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table.
- CVE-2026-46489High
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepted any file type without validation, allowing SVG files with embedded JavaScript to be uploaded.
Original NVD description (English source)
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.