SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-61614

MEDIUM · CVSS 5.9 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The SolidInvoice open-source invoicing platform prior to version 3.0.1 is vulnerable due to its REST API authenticator accepting bearer tokens via a URL query parameter, which can lead to sensitive API credentials being exposed in server and proxy logs, browser history, and HTTP Referer headers. This vulnerability poses a risk of credential leakage, potentially allowing unauthorized access to the API. Organizations using SolidInvoice should prioritize upgrading to version 3.0.1 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-61614
Severity
MEDIUM
CVSS
5.9
EPSS
0.28%

Original NVD Description

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.