Vendor
SolidInvoice
6 known vulnerabilities.
Products
3 results · Clear filters · Feed
-
Medium 6.5
SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGr…
-
Medium 5.9
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in…
-
Medium 6.8
SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at…