Quick answers
- Is CVE-2026-61688 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-61688 being exploited in the wild.
- How severe is CVE-2026-61688?
- Medium severity, with a CVSS score of 6.5, published 4 September 2026.
- Which products and versions are affected?
- SolidInvoice prior to 3.0.1.
- Is there a fix for CVE-2026-61688?
- A patch was published on 2026-06-23: Version 3.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-61688 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-61688?
- Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the ApiTokenHistoryGrid component. The DataGrid Symfony UX LiveComponent exposes the "name" and "context" props as writable (LiveProp(writable: true)), allowing clients to supply arbitrary values. ApiTokenHistoryGrid filters API token history records by a token_id from context without verifying that the token belongs to the currently authenticated user. While Doctrine's CompanyFilter scopes results to the current company, there is no ownership check. An authenticated attacker can POST to the LiveComponent update endpoint with a victim's token ULID to enumerate their complete API request history. The fix (version 3.0.1) adds a join against the ApiToken entity and filters by the currently authenticated user before applying the token_id constraint.
Affected products
- SolidInvoice SolidInvoice prior to 3.0.1
Timeline
- 2026-07-16: disclosed
- 2026-06-23: patched: Version 3.0.1 released with fix