Description

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-04T18:17:55.147Z",
  "pubdate": "2026-09-04T18:17:55.147Z",
  "executiveSummary": "SolidInvoice versions prior to 3.0.1 contain a critical security vulnerability involving the lifecycle management of UserInvitation entities.\nThe application fails to implement an expiry mechanism for invitation tokens sent via email, resulting in invitation links remaining valid indefinitely.\nThis flaw allows unauthorized access to company accounts if an invitation link is intercepted, forwarded, or retrieved from historical email archives.\nAn attacker can exploit this condition to gain unauthorized entry to a company platform or silently associate a compromised email address with an existing organization.\nThe vulnerability represents a failure in access control and session management logic, posing significant risks to organizational data confidentiality and integrity.\nExploitation requires no special privileges other than possession of a legitimate, albeit stale, invitation token. The issue is resolved in version 3.0.1 by introducing timestamp validation for invitation entities.",
  "technicalDetails": "The vulnerability resides within the UserInvitation entity processing logic in SolidInvoice, specifically in how the system validates tokenized invitations during the registration or account-joining flow.\nThe root cause is the absence of an expiration timestamp field or associated validation logic within the UserInvitation entity schema. By design, the application treated these tokens as permanent authorization keys rather than time-bound, single-use, or short-lived credentials.\nThe attack flow begins with the initial generation of an invitation link by an authorized administrator or system process. This link is transmitted to the target user via SMTP. Because the server-side validation logic does not check for token age or expiration, any attacker who gains access to this URL—through email server compromise, shoulder surfing, misdirected delivery, or long-term access to an archived email—can utilize the link at any time to initialize or complete the invitation process.\nAuthentication requirements: None for the initial exploitation step. The link acts as the authentication vector, granting the bearer the ability to associate their identity or an email address with the target company's infrastructure.\nPrivilege requirements: While the invitation itself may grant specific role-based permissions, the initial act of joining the company through the link requires no existing account or pre-authentication. This effectively bypasses standard account lifecycle management controls.\nNetwork exposure: The vulnerability is exposed wherever the invitation registration endpoint is reachable. Since the link is intended to be distributed via external email services, the exposure is essentially public internet-facing.\nPayload behavior: The application accepts the token from the URL, validates it against the database, and proceeds to authorize the requestor based on the invitation's stored association. Because no expiry check exists, the system cannot distinguish between a recent, legitimate invitation and a compromised, historical one.\nPost-exploitation impact: Successful exploitation results in unauthorized users gaining access to company resources, sensitive project data, or client invoicing details. Furthermore, an attacker can silently link a compromised or controlled email address to an existing company account, potentially allowing for future unauthorized access or long-term data harvesting without the knowledge of the original invitation sender."
}