CVE-2026-61688: SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolidInvoiceto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
SolidInvoice deployments running versions prior to 3.0.1 are affected. Exploitation is limited to authenticated users accessing data within the same company.
What does an attacker need to exploit it?
An attacker needs a valid authenticated SolidInvoice account in the target company. They can manipulate two writable Symfony UX LiveComponent properties on the DataGrid component to access another user's API token request history.
Is sensitive token material exposed?
The issue exposes API request history associated with other users' API tokens. The provided information does not state that the API token values themselves are disclosed.
What should teams do to remediate the issue?
Upgrade SolidInvoice to version 3.0.1, which fixes the vulnerability.