Executive brief
SolidInvoice is an open-source invoicing platform that manages financial transactions and API integrations for businesses. An authenticated user can view the complete API request history of any other user in the same company, including their IP addresses, endpoints called, and request payloads, by manipulating component properties. This allows attackers to spy on colleagues' API activity and infer business logic or operational patterns.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the ApiTokenHistoryGrid component. The DataGrid Symfony UX LiveComponent exposes the "name" and "context" props as writable (LiveProp(writable: true)), allowing clients to supply arbitrary values. ApiTokenHistoryGrid filters API token history records by a token_id from context without verifying that the token belongs to the currently authenticated user. While Doctrine's CompanyFilter scopes results to the current company, there is no ownership check. An authenticated attacker can POST to the LiveComponent update endpoint with a victim's token ULID to enumerate their complete API request history. The fix (version 3.0.1) adds a join against the ApiToken entity and filters by the currently authenticated user before applying the token_id constraint.
Affected products
- SolidInvoice SolidInvoice prior to 3.0.1
Timeline
- 2026-07-16: disclosed
- 2026-06-23: patched: Version 3.0.1 released with fix