Is CVE-2026-83743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83743 being exploited in the wild.

How severe is CVE-2026-83743?

Medium severity, with a CVSS score of 6.3, published 1 September 2026.

Is there a fix for CVE-2026-83743?

A patch was published on 2026-09-01: Fixed in version 5.13.27 (commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83743 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-83743?

Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83743: Invoice Ninja authorization bypass in vendor portal profile

CVE-2026-83743 · Severity: medium · CVSS 6.3 · Published 2026-09-01

Invoice Ninja is a popular open-source invoicing platform used by businesses and vendors to manage billing and client relationships. A flaw in the vendor portal profile update feature allows any authenticated vendor to access and modify other vendors' profile information—including email addresses—by manipulating request parameters. An attacker could change a victim vendor's email and use password reset to take over their account.

Technologies: Invoice Ninja. Vendors: Invoice Ninja.

Quick answers

Is CVE-2026-83743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83743 being exploited in the wild.
How severe is CVE-2026-83743?: Medium severity, with a CVSS score of 6.3, published 1 September 2026.
Which products and versions are affected?: Invoice Ninja up to 5.13.26.
Is there a fix for CVE-2026-83743?: A patch was published on 2026-09-01: Fixed in version 5.13.27 (commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83743 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-83743?: Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a broken access control vulnerability (IDOR / Insecure Direct Object Reference) in the vendor profile update endpoint. The vulnerable component is the Vendor Portal Profile Update functionality, which uses Laravel route model binding to resolve VendorContact objects but fails to validate whether the authenticated vendor owns the resource before allowing read or write operations. An authenticated attacker (with valid vendor credentials) can manipulate the vendor_contact parameter in the request to an arbitrary VendorContact ID, bypassing authorization checks and gaining unauthorized access to other vendors' profiles. The attack requires authentication but no elevated privileges. Exploitation allows changing email addresses, potentially leading to complete account takeover via password reset. Version 5.13.27 and the commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90 contain fixes implementing proper authorization checks.

Affected products

Invoice Ninja Invoice Ninja up to 5.13.26

Timeline

2026-09-01: disclosed: Public disclosure via NVD
2026-09-01: patched: Fixed in version 5.13.27 (commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.