CVE-2026-110765 Details
Description
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
An authentication bypass vulnerability has been identified in FlexPrice versions through 2.1.38, specifically within the QuickBooks webhook handling function. The vulnerability arises because the function omits signature verification when the 'intuit-signature' header is absent. This flaw allows unauthenticated attackers, who are aware of the tenant and environment IDs, to replay forged payment notifications. As a result, they can manipulate payment amounts on invoices, potentially marking them as paid or overpaid.
Users are advised to update to a version of FlexPrice that addresses this vulnerability. QuickBooks connections should be configured with a webhook verifier token to ensure proper signature verification.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FlexPrice | <= 2.1.38 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | New CVE Received | [email protected] |