SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
Priority MEDIUM 62CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Fix Fixed SolidInvoice (SolidInvoice): 3.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolidInvoice | SolidInvoice | before 3.0.1 | 3.0.1 | Patch available | CNA |
- SolidInvoice VendorSolidInvoice Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
Remediation
- Fix · CNA SolidInvoice (SolidInvoice) Fixed in 3.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61688
References
More SolidInvoice vulnerabilities
- TI-2026-34278 SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach CVSS 3.1HIGH 8.1
- TI-2026-34188 SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo CVSS 3.1HIGH 8.1
- TI-2026-44163 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop CVSS 3.1HIGH 7.5
- TI-2025-35046 SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in… CVSS 3.1MEDIUM 5.4
- TI-2025-35045 SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in… CVSS 3.1MEDIUM 5.4
- TI-2025-08409 SolidInvoice Clients clients cross site scripting CVSS 4.0MEDIUM 5.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences