Invoice Ninja CVE-2026-83744

Exploitation requires a valid authenticated session with at minimum low-privilege access to the Invoice Ninja application, as confirmed by the CVSS 4.0 vector metric PR:L. The attacker must have permission to create or edit invoices on the affected invoices endpoint and trigger PDF generation. The specific vulnerable surface is the notes argument passed to Purify::isHostSafe() in app/Services/Pdf/Purify.php. Exploitation impact is bounded by the server's outbound network reachability: the SSRF is most dangerous when the server can reach internal services, cloud metadata endpoints, or other non-public infrastructure. No unauthenticated exploitation path is indicated by the available data. Versions above 5.13.26 have not been confirmed affected.

The CVSS 4.0 score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) accurately reflects a constrained, authenticated SSRF with limited confidentiality impact and no integrity or availability effect. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread or nation-state exploitation at time of analysis. However, the existence of a public proof-of-concept on the researcher's blog meaningfully raises the likelihood of opportunistic exploitation compared to an undisclosed finding. The practical risk is highly deployment-dependent: in environments where the Invoice Ninja server has unrestricted outbound access to cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, the SSRF can be escalated into credential theft and lateral movement well beyond what the raw CVSS score implies. Egress-filtered or network-isolated deployments face substantially lower risk. The vendor's complete non-response to coordinated disclosure is an aggravating factor, as it removes any expectation of a near-term patch and leaves operators without official guidance.

An authenticated user with low-privilege access - such as a client portal user or a staff account without administrative rights - navigates to the invoices endpoint and injects a crafted URL (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) into the invoice notes field. Upon triggering PDF generation, the server's Purify::isHostSafe() function fails to block the request, causing the server to fetch the target URL and potentially expose cloud IAM credentials or enumerate internal services. A public proof-of-concept demonstrating this technique is available on the researcher's blog.