High · 7.5 CVE-2026-71626 EUVD-2026-71744GHSA-rqwx-vcc8-2j32

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookR…

Published Sep 4, 2026 · Updated Sep 8, 2026 · Assigned by mitre

Description

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components

References

https://colorful-quill-4fe.notion.site/CVE-2026-71626-API-Webhook-SSRF-via-Internal-and-Loopback-Targets-382e5670300c80b6b4dac4c8216b5ff8?source=copy_link