Description

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T05:17:10.617Z",
  "pubdate": "2026-09-01T05:17:10.617Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in Invoice Ninja, affecting all versions up to 5.13.26.\nThe vulnerability resides within the Vendor Portal Profile Update component, specifically impacting the /vedor/profile/ file.\nBy manipulating the vendor_contact argument, a remote, unauthenticated, or unauthorized attacker can potentially bypass security controls and gain unauthorized access or modify sensitive vendor profile data.\nThe vulnerability is currently subject to public exploit availability, significantly increasing the risk of active exploitation in production environments.\nImmediate remediation is required, as the flaw allows attackers to perform unauthorized actions by circumventing intended access control checks within the application's profile management logic.\nThe vulnerability highlights a critical failure in input validation and access control enforcement within the vendor profile update process.",
  "technicalDetails": "The vulnerability is an authorization bypass flaw located in the Vendor Portal Profile Update module of Invoice Ninja. The affected path is /vedor/profile/, which processes profile management requests for vendor accounts.\nThe root cause of the vulnerability stems from insufficient server-side validation and improper authorization checks when handling the vendor_contact argument. When a request is sent to the profile update endpoint, the application fails to verify if the authenticated user has sufficient privileges or ownership rights to modify the specific vendor contact information being submitted.\nExploitation is achieved via remote manipulation of the vendor_contact parameter. An attacker can craft a malicious HTTP request that targets the /vedor/profile/ endpoint while injecting unexpected or unauthorized values into the vendor_contact argument. Because the application logic fails to perform a rigorous check between the session identity and the target vendor resource, the backend processes the request as a legitimate update command.\nThe attack flow follows a predictable sequence: First, the attacker identifies a target vendor profile. Second, the attacker interacts with the /vedor/profile/ component to initiate a modification request. Third, by manipulating the vendor_contact argument, the attacker bypasses the application's internal access control matrix. Fourth, the application persists the unauthorized changes to the database, granting the attacker the ability to alter vendor profiles or gain insights into administrative data.\nThe vulnerability is present in versions up to 5.13.26. Since the exploit is publicly disclosed, the barrier to entry for potential attackers is low, allowing for automated scanning and exploitation. Post-exploitation impact includes unauthorized modification of vendor profiles, which could lead to further account takeover, unauthorized data exposure, or lateral movement within the Invoice Ninja infrastructure.\nThe vulnerability emphasizes the need for strict object-level authorization (BOLA/IDOR protection) when handling arguments that reference external or privileged resource identifiers."
}