Is CVE-2026-82029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82029 being exploited in the wild.

How severe is CVE-2026-82029?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Is there a fix for CVE-2026-82029?

Yes: fixed in 5.13.28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82029 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82029?

Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82029: Invoice Ninja broken access control in vendor document download

CVE-2026-82029 · Severity: medium · CVSS 6.5 · Published 2026-11-04

Invoice Ninja is a web-based invoicing and expense management platform. Authenticated vendor-portal users could access sensitive documents (invoices, contracts, receipts) belonging to other vendors and clients in the same company due to insufficient access controls, exposing confidential financial information across company boundaries.

Technologies: Invoice Ninja. Vendors: Invoice Ninja.

Quick answers

Is CVE-2026-82029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82029 being exploited in the wild.
How severe is CVE-2026-82029?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: Invoice Ninja before 5.13.28.
Is there a fix for CVE-2026-82029?: Yes: fixed in 5.13.28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82029 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82029?: Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.13.28

Technical details

A broken access control vulnerability in the vendor document endpoints validates only company_id scope rather than verifying vendor ownership of documents. Attackers with valid vendor-portal authentication can enumerate sequential Hashids (due to default empty HASH_SALT) and request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple to read any document within the company, including invoices, contracts, and expense attachments.

Affected products

Invoice Ninja Invoice Ninja before 5.13.28

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.