EUVD-2026-71628Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H captures the indirect path through log/proxy/Referer artifacts; C:H reflects full API token compromise; I:N and A:N because credential disclosure alone has no direct integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
AnalysisAI
SolidInvoice's REST API authenticator, in all versions prior to 3.0.1, silently accepts long-lived bearer tokens via a ?token= URL query parameter as a fallback to the intended X-API-TOKEN request header, causing credentials to be permanently recorded in server access logs, reverse-proxy logs, CDN access logs, browser history, and HTTP Referer headers forwarded to third-party origins. Any actor with read access to those artifacts - sysadmins, log-aggregation pipelines, analytics vendors receiving Referer data, or post-compromise intruders pivoting through log stores - can extract a valid API token and authenticate to the invoicing platform without exploiting any application logic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that one or more of the following secondary artifacts are accessible to an attacker: web server or application access logs that record full request URIs, reverse-proxy or CDN access logs, browser address-bar history on a shared or compromised workstation, or HTTP Referer headers forwarded to third-party origins (e.g., embedded analytics scripts on pages that trigger API calls). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the high confidentiality impact - a stolen API token grants full programmatic access to invoicing data - tempered by AC:H, which captures the indirect exploitation path: an attacker cannot obtain the token from the network directly but must access a secondary artifact such as logs, proxy records, browser history, or Referer telemetry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to SolidInvoice version 3.0.1, which removes the `?token=` URL query parameter fallback and requires API credentials to be submitted exclusively via the `X-API-TOKEN` HTTP request header (PR #2514). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Solidinvoice
View allSolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. Rated mediu
Plaintext credential exposure in SolidInvoice open-source invoicing platform prior to 2.3.17 allows any actor with read
Stored cross-site scripting in SolidInvoice prior to 2.3.17 allows an authenticated administrator to upload a malicious
PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-priv
Invitation links in SolidInvoice prior to version 3.0.1 never expire because UserInvitation entities carry no expiry tim
Cross-user API history disclosure in SolidInvoice prior to version 3.0.1 allows any authenticated company member to read
A security flaw has been discovered in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is
A vulnerability was identified in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remo
A vulnerability was determined in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remo
A vulnerability was found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely
A vulnerability has been found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remo
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. Ra
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today