CVE-2026-61608CWE-613

CVE-2026-61608

Medium · published September 4, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 14.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-04T22:17Z
References (2)
https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1 · [email protected]https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-5gcp-fm29-jgrp · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 17:46Z
    SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
    cvelistv5