CVE-2026-61688 in SolidInvoice
Summary
by MITRE • 09/04/2026
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
SolidInvoice is a widely utilized open-source invoicing platform designed to help businesses manage billing, payments, and client relationships efficiently. In versions prior to 3.0.1, the application contained a critical security flaw related to access control within its administrative interface. Specifically, the vulnerability stems from improper implementation of authorization checks in the Symfony UX LiveComponent framework used for rendering data grids. This architectural choice allows dynamic updates to user interfaces without full page reloads, but it introduces risks if server-side validation is not strictly enforced against client-side manipulation.
The core technical flaw involves two writable properties within the DataGrid component that control which API request history records are displayed. These props allow an authenticated user to modify parameters sent from their browser to the backend logic responsible for fetching and displaying data. Because the application fails to verify whether the requesting user has permission to view the specific resource identified by these manipulated props, it results in a Broken Access Control vulnerability. An attacker who possesses valid credentials for any account within the same organization can exploit this flaw by intercepting network traffic or manipulating frontend inputs to change the identifier associated with another user's API tokens.
This lack of object-level authorization enables an authenticated insider threat to access sensitive operational data belonging to colleagues. The exposed information includes detailed logs of API requests made using other users' authentication tokens. Such logs often contain metadata about when and how frequently specific endpoints are accessed, which can reveal internal business logic, third-party integrations, or the structure of private APIs. While the vulnerability does not directly allow for immediate code execution or full account takeover on its own, it significantly expands the attack surface by providing reconnaissance data that could facilitate further exploitation attempts against other systems connected via those API tokens.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control and is relevant to MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to access unauthorized resources within the same tenant environment. The impact is primarily informational but can lead to serious privacy violations and potential compromise of integrated services if API keys are exposed or reused improperly across different security domains.
To mitigate this vulnerability, organizations running SolidInvoice versions earlier than 3.0.1 must upgrade immediately to version 3.0.1 or later where the issue has been resolved by enforcing strict server-side authorization checks on all data grid operations. Developers should also review other components using Symfony UX LiveComponents to ensure that no similar patterns of client-driven resource identification exist without corresponding backend validation. Implementing principle of least privilege and ensuring that every API endpoint verifies user permissions against the requested resource ID is essential for maintaining robust access control in multi-tenant or shared-environment applications.