EUVD-2026-36301Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitation presupposes attacker-controlled database read access (modeled as PR:H), after which token reuse over the network is trivial (AV:N/AC:L) with full read/write API impact and no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database - through SQL injection, a leaked backup, a misconfigured replica, or insider access - immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
AnalysisAI
Plaintext credential exposure in SolidInvoice open-source invoicing platform prior to 2.3.17 allows any actor with read access to the application database to harvest every user's REST API token directly from the api_tokens table. Because tokens are stored unhashed, secondary exposures such as SQL injection, stolen backups, replicated databases, or insider access become full account-takeover paths against the API. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must first obtain read access to the api_tokens table of the SolidInvoice database - via a separate SQL injection in SolidInvoice or a co-hosted app, an exposed or stolen database backup, a misconfigured replica, or insider database access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, 8.1) reflects that the vulnerability itself is realized only after a separate compromise grants database read - PR:L is essentially a stand-in for that prior access rather than an application-level role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker exploits an unrelated SQL injection in another component, dumps the api_tokens table, and immediately replays the plaintext values against SolidInvoice's REST API as any user - bypassing password and MFA. Equivalent outcomes follow from obtaining a recent database backup left on shared storage or accessing a misconfigured read replica. … |
| Remediation | Vendor-released patch: upgrade SolidInvoice to 2.3.17 or later (https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17), which ships the Version20317 migration that re-hashes existing rows in place so issued tokens keep working. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all SolidInvoice deployments and verify versions; assess database access controls and network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today