CVE-2026-61608 Details

A vulnerability exists in SolidInvoice versions prior to 3.0.1, where 'UserInvitation' entities lack an expiry timestamp. This oversight allows invitation links sent to users to remain valid indefinitely. As a result, a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. The absence of an expiry mechanism poses a risk of unauthorized access to company invoicing data, as there is no re-confirmation step, IP restriction, or notification to existing company admins when an invitation is accepted.

Users can upgrade to SolidInvoice version 3.0.1 or later, where this vulnerability has been addressed. Instructions for upgrading can be found in the SolidInvoice GitHub repository.