CVE-2026-61614: falha de média gravidade em SolidInvoice
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.4%
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
SolidInvoice · SolidInvoiceCVEs relacionadas — SolidInvoice
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61686HIGHSolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context propEPSS 0.4%CVE-2026-61688MEDIUMSolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent propsEPSS 0.4%CVE-2026-61608MEDIUMSolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksEPSS 0.3%CVE-2026-46489HIGHSolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logoEPSS 0.3%CVE-2026-46622HIGHSolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breachEPSS 0.2%