Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-61688

SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SolidInvoice SolidInvoice

  • < 3.0.1affected

References