CVE-2026-83743mediumCWE-285CWE-639

CVE-2026-83743: falha de média gravidade em invoiceninja Invoice Ninja

invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

Publicada em

Seguir esta CVE+ Monitorar invoiceninja

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.3epss 0.4%
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
invoiceninja · Invoice Ninja
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — invoiceninja Invoice Ninja

No mesmo produto, das mais perigosas para as menos.

CVE-2026-83744MEDIUMinvoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgeryEPSS 0.3%