CVE-2026-61608: SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolidInvoiceto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using SolidInvoice versions before 3.0.1 are exposed if invitation links have been sent to users. Any leaked, forwarded, or archived invitation email may remain usable indefinitely.
What does an attacker need to exploit it?
An attacker needs access to a valid SolidInvoice user invitation link. No authenticated SolidInvoice account is required, but the attacker must use the link to complete the invitation flow.
How can I tell whether old invitations may still be a risk?
If the installation is running a version before 3.0.1 and has issued user invitations, previously sent invitation emails should be treated as potentially valid regardless of their age. The issue exists because UserInvitation entities do not have an expiry timestamp in affected versions.
What should be done if upgrading cannot happen immediately?
The provided data identifies version 3.0.1 as the fix. Until it can be deployed, treat previously issued invitation links as active credentials and account for the possibility that recipients, email archives, or unauthorized parties may still possess them.