Executive brief
SolidInvoice is an open-source invoicing platform that allows companies to manage invoices, quotes, and client data. Prior to version 3.0.1, invitation links sent to new users never expire, meaning leaked, archived, or forwarded invitation emails can be exploited indefinitely to gain unauthorized access to company invoicing records, client information, and payment details.
Technical details
The vulnerability is an insufficient session expiration issue (CWE-613) in the `UserInvitation` entity, which stores only a creation timestamp but defines no expiry or time-to-live mechanism. The `AcceptInvitation` action performs no staleness check when processing invitation tokens; it simply verifies the invitation ID exists and adds the invited email address to the target company with no re-confirmation, IP restriction, or admin notification. An attacker who obtains an old invitation link (via email compromise, forwarding, archives, or phishing) can use it at any time to join the company and access all invoicing data. The fix in version 3.0.1 adds an `expiresAt` field to `UserInvitation`, sets expiry on creation (typically 7 days), and rejects expired invitations during acceptance.
Affected products
- SolidInvoice SolidInvoice < 3.0.1
Timeline
- 2026-07-16: disclosed: GitHub Security Advisory GHSA-5gcp-fm29-jgrp published
- 2026-09-04: disclosed: CVE-2026-61608 published on NVD
- 2026-06-23: patched: Version 3.0.1 released with fix