Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M
CVE-2026-61688SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in SolidInvoice from SolidInvoice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolidInvoice | SolidInvoice | < 3.0.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-jhv9-9fv9-67cr x_refsource_CONFIRM
- https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1 x_refsource_MISC