CVE-2026-61688CWE-639

CVE-2026-61688

Medium · published September 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-04T22:17Z
References (3)
https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1 · [email protected]https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-jhv9-9fv9-67cr · [email protected]https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-jhv9-9fv9-67cr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 17:49Z
    SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
    cvelistv5