Executive brief
SolidInvoice, an open-source invoicing and billing application, contains multiple security flaws that allow users within the same company to access or modify each other's private data. An authenticated user could view or delete other users' API tokens and steal notification credentials for services like Slack, Discord, or Telegram. This could lead to unauthorized access to external communication channels and the exposure of sensitive integration keys.
Technical details
SolidInvoice is vulnerable to multiple Insecure Direct Object Reference (IDOR) flaws within its Symfony LiveComponent implementation. The root cause is that several LiveAction and LiveProp components (specifically ApiTokens, ApiTokenHistory, NotificationIntegrations, and NotificationTransportConfiguration) resolve entity IDs provided by the client without verifying if the requesting user owns the entity. While the application uses a CompanyFilter for tenant isolation, it lacks granular user-level authorization checks. Attackers can revoke API tokens, view token usage history (IPs and user agents), disclose notification transport credentials (API keys for Slack/Discord), or take over transport settings by overwriting the owner field. The issue is resolved in version 2.3.16.
Affected products
- SolidInvoice SolidInvoice <= 2.3.15
Timeline
- 2026-05-25: disclosed
- 2026-06-26: advisory
- 2026-06-26: patched: Fixed in version 2.3.16