Is CVE-2026-61614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61614 being exploited in the wild.

How severe is CVE-2026-61614?

Medium severity, with a CVSS score of 5.9, published 4 September 2026.

Is there a fix for CVE-2026-61614?

A patch was published on 2026-06-23: version 3.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61614 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61614?

Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61614: SolidInvoice REST API credential exposure via query parameter

CVE-2026-61614 · Severity: medium · CVSS 5.9 · Published 2026-09-04

SolidInvoice is an open-source invoicing platform used to manage invoices and customer billing. The REST API accepts authentication tokens as URL query parameters, causing long-lived API credentials to be recorded in server logs, browser history, and forwarded to third-party services. An attacker who gains access to these logs obtains persistent administrative access to the platform without the token owner's knowledge.

Technologies: SolidInvoice. Vendors: SolidInvoice.

Quick answers

Is CVE-2026-61614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61614 being exploited in the wild.
How severe is CVE-2026-61614?: Medium severity, with a CVSS score of 5.9, published 4 September 2026.
Which products and versions are affected?: SolidInvoice prior to 3.0.1.
Is there a fix for CVE-2026-61614?: A patch was published on 2026-06-23: version 3.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61614 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61614?: Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure credential transmission issue (CWE-598) in the REST API authenticator. The ApiTokenAuthenticator accepts bearer tokens via the ?token= URL query parameter as a fallback to the X-API-TOKEN header. Unlike header-based authentication, query parameters are logged by default in web server access logs (nginx, Apache, Caddy), reverse proxy logs, browser history, HTTP Referer headers to third-party origins, and APM tools. SolidInvoice API tokens are HMAC-SHA256 keyed values with no automatic expiry; once exposed in logs, they grant indefinite API access until manually revoked. The fix (version 3.0.1) removes query parameter fallback and requires exclusive use of the X-API-TOKEN header. No authentication or user interaction is required to exploit this via log access.

Affected products

SolidInvoice SolidInvoice prior to 3.0.1

Timeline

2026-07-16: disclosed
2026-06-23: patched: version 3.0.1 released
2026-09-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.