Read the docs
TI-2026-85121 Aliases CVE-2026-82029GHSA-35wr-7cjw-8mx6

Broken access control in Invoice Ninja vendor portal exposes files

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Invoice Ninja before 5.13.28 contains a broken access control flaw in its vendor portal, where authorization checks validate only company scope and not vendor ownership (CWE-639). An authenticated vendor-portal contact can read invoices, contracts, payment receipts and expense attachments belonging to other vendors and clients by requesting predictable sequential document identifiers. The identifiers are predictable because the default HASH_SALT is empty.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed invoiceninja (invoiceninja): 5.13.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
invoiceninjainvoiceninjabefore 5.13.285.13.28Patch availableCNA
  • invoiceninja Vendorinvoiceninja Affected before 5.13.28 Fixed in 5.13.28 Patch available CNA

Remediation

Update Invoice Ninja to version 5.13.28 or later, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA invoiceninja (invoiceninja) Fixed in 5.13.28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-82029
  2. 2026-11-04 Alias added: GHSA-35wr-7cjw-8mx6
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 1

  • TI-2026-23400 Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. CVSS 3.1HIGH 7.7
  • TI-2026-26121 Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes CVSS 3.1MEDIUM 5.4
  • TI-2026-26010 Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items CVSS 3.1MEDIUM 5.4
  • TI-2026-57726 invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery CVSS 4.0MEDIUM 5.3
  • TI-2026-57725 invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization CVSS 4.0MEDIUM 5.3
  • TI-2026-42060 Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter CVSS 4.0MEDIUM 5.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences