FlexPrice EUVD-2026-101565

Exploitation requires the FlexPrice QuickBooks webhook integration (HandleQuickBooksWebhook) to be configured and its endpoint network-reachable, and the attacker must know a valid tenant and environment ID (reflected as AT:P in the CVSS 4.0 vector). The core defect is that omitting the intuit-signature header entirely causes the server to skip signature verification rather than reject the request, so no valid signature or secret is needed. Limiting factors: the requirement to possess or enumerate correct tenant/environment identifiers and the need for QuickBooks billing integration to be in use; deployments not using QuickBooks webhooks are unaffected. No user interaction or authentication is required once the IDs are known.

This is a credible, moderate-to-high integrity risk, but not a drop-everything emergency. The CVSS 4.0 base score of 8.2 is driven entirely by integrity impact (VI:H) with no confidentiality or availability impact (VC:N/VA:N), which matches the described behavior: forged payment notifications corrupt invoice/payment state rather than exposing data or crashing the service. The vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N), lowering the barrier, but it carries AT:P (attack requirement present) because the attacker must first know a valid tenant and environment ID - a genuine gating factor that distinguishes this from a fully trivial AV:N/AC:L/AT:N bug. No EPSS score, KEV listing, or explicit exploit-code flag was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; however, a detailed third-party technical writeup (hackmd) and a VulnCheck advisory exist, which materially lowers the effort to weaponize. The signals are internally consistent - CWE-347 (improper signature verification), the 'Authentication Bypass' tag, and the description all align. The main uncertainty is how guessable/enumerable tenant and environment IDs are in practice; if they are sequential or leak elsewhere, real-world exploitability rises toward the CVSS implication. Prioritize patching for any production FlexPrice deployment using the QuickBooks webhook integration, but this is lower urgency than a KEV-listed RCE.

An attacker who has obtained or guessed a valid tenant and environment ID sends an HTTP POST to the QuickBooks webhook endpoint while deliberately omitting the intuit-signature header, causing FlexPrice to skip signature verification entirely. They replay a forged payment-notification payload repeatedly, incrementing recorded payment amounts until target invoices are marked paid or overpaid. A detailed technical writeup and vendor advisory exist, but no packaged public exploit code was indicated in the input.