| 제목 | invoiceninja Invoice Ninja 5.13.26 Broken Access Control (IDOR) |
|---|
| 설명 | A critical broken access control vulnerability exists in the vendor portal profile update functionality of Invoice Ninja v5.13.26. The application fails to verify that the authenticated vendor owns the referenced VendorContact object during route model binding, allowing an authenticated attacker to manipulate the vendor_contact identifier to view and modify another vendor's profile information. This includes changing sensitive fields such as the email address, which may facilitate account takeover through the password reset process. |
|---|
| 원천 | ⚠️ https://ashutosh-jena.in/blog/broken-access-control-idor-in-invoice-ninja-vendor-portal-v51326 |
|---|
| 사용자 | MAVERICK-VF142 (UID 99541) |
|---|
| 제출 | 2026. 07. 04. AM 11:49 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 01. AM 12:52 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397499 [invoiceninja Invoice Ninja 까지 5.13.26 Vendor Portal Profile Update /vedor/profile/ vendor_contact 권한 상승] |
|---|
| 포인트들 | 20 |
|---|