CVE-2026-82029
Received Received - Intake

Broken Access Control in Invoice Ninja Exposes Sensitive Documents

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-82029
EUVD
EUVD-2026-117017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
invoiceninja invoiceninja 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Invoice Ninja before version 5.13.28 has a broken access control flaw where authenticated vendor-portal contacts can access documents belonging to other vendors and clients. The system only checks company_id scope instead of verifying vendor ownership, allowing attackers to exploit predictable sequential Hashids document identifiers (due to an empty HASH_SALT) to download sensitive files like invoices, contracts, and receipts.

Detection Guidance

Check Invoice Ninja logs for repeated unauthorized document download attempts via GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple endpoints. Verify if HASH_SALT is empty in configuration files. Monitor for sequential Hashid enumeration patterns in access logs.

Impact Analysis

If you are a vendor or client using Invoice Ninja before 5.13.28, an attacker with vendor-portal access could steal your sensitive documents, including financial records, contracts, and payment receipts. This could lead to data breaches, financial fraud, or reputational damage.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (healthcare data privacy) by exposing sensitive personal or financial information without authorization. Organizations using affected versions risk non-compliance, legal penalties, and loss of trust due to unauthorized data access.

Mitigation Strategies

Upgrade Invoice Ninja to version 5.13.28 or later. Ensure HASH_SALT is set to a non-empty value in configuration. Review and restrict vendor portal contact permissions. Implement stricter access controls to validate vendor ownership beyond company_id scope.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...