CVE-2026-46622: SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the apitokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolidInvoiceto a version that resolves this vulnerability.Fixed in 2.3.17 - Compensating control
Restrict and monitor read access to the database (including backups and replicas), remediate SQL injection vulnerabilities, and limit insider access so that unauthorized parties cannot obtain database read access.
- Operational
Rotate and invalidate all API tokens/credentials after applying the fix to ensure any tokens that may have been exposed via database read access are no longer valid.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46622?
The severity of CVE-2026-46622 is rated as high with a score of 8.1.
How do I fix CVE-2026-46622?
To fix CVE-2026-46622, upgrade SolidInvoice to version 2.3.17 or later.
What risks are associated with CVE-2026-46622?
CVE-2026-46622 poses the risk of full credential compromise if an attacker gains access to the database.
What specific vulnerability does CVE-2026-46622 exploit?
CVE-2026-46622 exploits the storage of API tokens as plaintext in the database.
What can cause an attacker to access the database related to CVE-2026-46622?
An attacker can access the database through vulnerabilities like SQL injection, leaked backups, or misconfigurations.