CyberRota Analysis
AI-GeneratedSolidInvoice versions prior to 3.0.1 are vulnerable due to the lack of an expiry timestamp for `UserInvitation` entities, allowing invitation links to remain valid indefinitely. This could lead to unauthorized access if an invitation email is leaked or forwarded, potentially compromising user accounts and company data. Organizations using SolidInvoice should prioritize upgrading to version 3.0.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.