# CVE-2026-61614: SolidInvoice REST API credential exposure via query parameter

Source: https://junglewise.ai/threats/cve-2026-61614-solidinvoice-rest-api-credential-exposure-via-query-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61614 · Severity: medium · CVSS 5.9 · Published 2026-09-04

SolidInvoice is an open-source invoicing platform used to manage invoices and customer billing. The REST API accepts authentication tokens as URL query parameters, causing long-lived API credentials to be recorded in server logs, browser history, and forwarded to third-party services. An attacker who gains access to these logs obtains persistent administrative access to the platform without the token owner's knowledge.

Technologies: [SolidInvoice](https://junglewise.ai/threats/technologies/solidinvoice). Vendors: [SolidInvoice](https://junglewise.ai/threats/vendors/solidinvoice).

## Quick answers

**Is CVE-2026-61614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61614 being exploited in the wild.

**How severe is CVE-2026-61614?** Medium severity, with a CVSS score of 5.9, published 4 September 2026.

**Which products and versions are affected?** SolidInvoice prior to 3.0.1.

**Is there a fix for CVE-2026-61614?** A patch was published on 2026-06-23: version 3.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61614 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61614?** Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure credential transmission issue (CWE-598) in the REST API authenticator. The ApiTokenAuthenticator accepts bearer tokens via the ?token= URL query parameter as a fallback to the X-API-TOKEN header. Unlike header-based authentication, query parameters are logged by default in web server access logs (nginx, Apache, Caddy), reverse proxy logs, browser history, HTTP Referer headers to third-party origins, and APM tools. SolidInvoice API tokens are HMAC-SHA256 keyed values with no automatic expiry; once exposed in logs, they grant indefinite API access until manually revoked. The fix (version 3.0.1) removes query parameter fallback and requires exclusive use of the X-API-TOKEN header. No authentication or user interaction is required to exploit this via log access.

## Affected products

- SolidInvoice SolidInvoice prior to 3.0.1

## Timeline

- 2026-07-16: disclosed
- 2026-06-23: patched: version 3.0.1 released
- 2026-09-04: advisory

## References

- [https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1](https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1)
- [https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-mp4c-675j-mv67](https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-mp4c-675j-mv67)

## Related threats

- [SolidInvoice authorization bypass in API token history grid](https://junglewise.ai/threats/cve-2026-61688-solidinvoice-authorization-bypass-in-api-token-history-grid)
- [SolidInvoice DataGrid unserialize() deserialization vulnerability](https://junglewise.ai/threats/cve-2026-61686-solidinvoice-datagrid-unserialize-deserialization-vulnerability)
- [SolidInvoice user invitation indefinite validity](https://junglewise.ai/threats/cve-2026-61608-solidinvoice-user-invitation-indefinite-validity)
- [SolidInvoice IDOR in LiveComponent allows cross-user data access](https://junglewise.ai/threats/solidinvoice-idor-in-livecomponent-allows-cross-user-data-access-95c68549)
- [SolidInvoice plaintext storage of API tokens](https://junglewise.ai/threats/cve-2026-46622-solidinvoice-plaintext-storage-of-api-tokens)