CVE-2026-82029: Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only companyid scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/downloadmultiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASHSALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs an authenticated vendor-portal contact account. No user interaction is required.
Are default deployments especially exposed?
Deployments using the default empty HASH_SALT are especially exposed because document Hashids can be enumerated as predictable sequential identifiers. This can enable requests for documents outside the attacker's vendor ownership.
What information could be disclosed?
An attacker may read documents belonging to other vendors and clients within the same company, including invoice PDFs, contracts, payment receipts, and expense attachments.