Executive brief
Invoice Ninja is a popular open-source invoicing platform used by businesses and vendors to manage billing and client relationships. A flaw in the vendor portal profile update feature allows any authenticated vendor to access and modify other vendors' profile information—including email addresses—by manipulating request parameters. An attacker could change a victim vendor's email and use password reset to take over their account.
Technical details
This is a broken access control vulnerability (IDOR / Insecure Direct Object Reference) in the vendor profile update endpoint. The vulnerable component is the Vendor Portal Profile Update functionality, which uses Laravel route model binding to resolve VendorContact objects but fails to validate whether the authenticated vendor owns the resource before allowing read or write operations. An authenticated attacker (with valid vendor credentials) can manipulate the vendor_contact parameter in the request to an arbitrary VendorContact ID, bypassing authorization checks and gaining unauthorized access to other vendors' profiles. The attack requires authentication but no elevated privileges. Exploitation allows changing email addresses, potentially leading to complete account takeover via password reset. Version 5.13.27 and the commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90 contain fixes implementing proper authorization checks.
Affected products
- Invoice Ninja Invoice Ninja up to 5.13.26
Timeline
- 2026-09-01: disclosed: Public disclosure via NVD
- 2026-09-01: patched: Fixed in version 5.13.27 (commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90)