CVE-2026-61614
Received Received - Intake

Bearer Token Exposure in SolidInvoice REST API

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-61614
EUVD
EUVD-2026-71628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
solidinvoice solidinvoice to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SolidInvoice versions before 3.0.1 have a vulnerability where bearer tokens can be passed via a URL query parameter named token. This means API credentials are exposed in server logs, proxy logs, browser history, and HTTP Referer headers sent to third parties.

Detection Guidance

Check server access logs for URLs containing '?token=' parameters. Inspect proxy logs for similar patterns. Review browser history for exposed tokens. Monitor HTTP Referer headers for third-party data leaks.

Impact Analysis

If exploited, attackers could access long-lived API credentials logged in various places. This could lead to unauthorized access to invoicing data, financial information, or other sensitive details handled by SolidInvoice.

Compliance Impact

This vulnerability could violate GDPR due to unauthorized access to personal data and HIPAA if protected health information is exposed. It risks non-compliance with data protection requirements for secure credential handling.

Mitigation Strategies

Upgrade SolidInvoice to version 3.0.1 or later. Remove any existing bearer tokens from logs and browser history. Configure servers to reject URLs with '?token=' parameters. Rotate all API credentials if tokens were exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart