CVE-2026-46622 Details
Description
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
A vulnerability exists in SolidInvoice versions prior to 2.3.17, where API tokens for authenticating REST API requests are stored in plaintext in the database. This issue allows any attacker with read access to the database to obtain all API credentials for every user, without any additional effort. The vulnerability can be exploited through SQL injection, a leaked backup, a misconfigured replica, or insider access. The impact is severe, as it allows unauthorized access to all API functionalities, including sensitive data manipulation and retrieval.
Users can upgrade to SolidInvoice version 2.3.17 or later, where this vulnerability has been patched. After upgrading, the API tokens are stored as HMAC-SHA256 hashes, keyed by the application secret, instead of plaintext. Existing tokens are rehashed during the upgrade process, ensuring that previously issued tokens continue to work without user intervention.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/SolidInvoice/SolidInvoice/commit/864539182572e1a3b2d76999b03060661ffa00f1 | [email protected] | Source CodeVendor |
| https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17 | [email protected] | Release NotesVendor |
| https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SolidInvoice | <= 2.3.16 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |