# CVE-2026-71626: Invoice Ninja information disclosure via webhook components

Source: https://junglewise.ai/threats/cve-2026-71626-invoice-ninja-information-disclosure-via-webhook-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71626 · Severity: high · CVSS 7.5 · Published 2026-09-04

Invoice Ninja is a web-based invoicing and accounting platform used by businesses to manage billing operations. A vulnerability in versions up to 5.13.24 allows a remote attacker to access sensitive information through webhook-related API endpoints, potentially exposing customer data, financial records, or API credentials without authentication.

Technologies: [Invoice Ninja](https://junglewise.ai/threats/technologies/invoice-ninja). Vendors: [Invoice Ninja](https://junglewise.ai/threats/vendors/invoice-ninja).

## Quick answers

**Is CVE-2026-71626 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71626 being exploited in the wild.

**How severe is CVE-2026-71626?** High severity, with a CVSS score of 7.5, published 4 September 2026.

**Which products and versions are affected?** Invoice Ninja up to 5.13.24.

**Is there a fix for CVE-2026-71626?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71626 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71626?** Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components of Invoice Ninja. It is classified as an information disclosure issue (CWE-200) that permits unauthenticated remote access to sensitive data via the webhook API endpoints. The attack requires only network connectivity to the affected Invoice Ninja instance; no prior authentication or user interaction is needed. An attacker can exploit this to retrieve confidential information such as webhook configurations, API keys, or related sensitive data. Patches are available in versions later than 5.13.24.

## Affected products

- Invoice Ninja Invoice Ninja up to 5.13.24

## Timeline

- 2026-09-04: disclosed

## References

- [https://colorful-quill-4fe.notion.site/CVE-2026-71626-API-Webhook-SSRF-via-Internal-and-Loopback-Targets-382e5670300c80b6b4dac4c8216b5ff8?source=copy_link](https://colorful-quill-4fe.notion.site/CVE-2026-71626-API-Webhook-SSRF-via-Internal-and-Loopback-Targets-382e5670300c80b6b4dac4c8216b5ff8?source=copy_link)
- [https://colorful-quill-4fe.notion.site/CVE-2026-71626-API-Webhook-SSRF-via-Internal-and-Loopback-Targets-382e5670300c80b6b4dac4c8216b5ff8](https://colorful-quill-4fe.notion.site/CVE-2026-71626-API-Webhook-SSRF-via-Internal-and-Loopback-Targets-382e5670300c80b6b4dac4c8216b5ff8)

## Related threats

- [Invoice Ninja broken access control in vendor document download](https://junglewise.ai/threats/cve-2026-82029-invoice-ninja-before-5-13-28-contains-a-broken-access-control)
- [Invoice Ninja server-side request forgery in PDF rendering](https://junglewise.ai/threats/cve-2026-83744-invoice-ninja-server-side-request-forgery-in-pdf-rendering)
- [Invoice Ninja authorization bypass in vendor portal profile](https://junglewise.ai/threats/cve-2026-83743-invoice-ninja-authorization-bypass-in-vendor-portal-profile)
- [Invoice Ninja open redirect in client portal login](https://junglewise.ai/threats/cve-2026-58450-invoice-ninja-open-redirect-in-client-portal-login)