CVE Feed

    Dashboard / CVE / CVE-2026-110765

    CVE-2026-110765

    FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

    Published:Oct 14, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00225
    CVSS Score:5.9

    Affected Products

    Vendor
    Flexprice
    Product
    Flexprice

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High