Quick answers
- Is CVE-2026-61608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-61608 being exploited in the wild.
- How severe is CVE-2026-61608?
- Medium severity, with a CVSS score of 6.8, published 4 September 2026.
- Which products and versions are affected?
- SolidInvoice < 3.0.1.
- Is there a fix for CVE-2026-61608?
- A patch was published on 2026-06-23: Version 3.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-61608 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-61608?
- Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an insufficient session expiration issue (CWE-613) in the `UserInvitation` entity, which stores only a creation timestamp but defines no expiry or time-to-live mechanism. The `AcceptInvitation` action performs no staleness check when processing invitation tokens; it simply verifies the invitation ID exists and adds the invited email address to the target company with no re-confirmation, IP restriction, or admin notification. An attacker who obtains an old invitation link (via email compromise, forwarding, archives, or phishing) can use it at any time to join the company and access all invoicing data. The fix in version 3.0.1 adds an `expiresAt` field to `UserInvitation`, sets expiry on creation (typically 7 days), and rejects expired invitations during acceptance.
Affected products
- SolidInvoice SolidInvoice < 3.0.1
Timeline
- 2026-07-16: disclosed: GitHub Security Advisory GHSA-5gcp-fm29-jgrp published
- 2026-09-04: disclosed: CVE-2026-61608 published on NVD
- 2026-06-23: patched: Version 3.0.1 released with fix