CVE-2026-61688

6.5 mediumEPSS 0.4%

Medium (6.5). EPSS 0.4% chance of exploitation in the next 30 days.

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-09-04
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1
https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-jhv9-9fv9-67cr
https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-jhv9-9fv9-67cr

Check your stack JSON