CVE-2026-61608

    Dashboard / Vulnerabilities / CVE-2026-61608

    CVE-2026-61608

    Published: 4 Sept 2026Last Modified: 12 Sept 2026

    Summary: SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links

    Details: SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.

    References: https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61608.json, https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-5gcp-fm29-jgrp, https://nvd.nist.gov/vuln/detail/CVE-2026-61608

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -43c16ecac6eca20a8f0001dfe3f1fa95732a0050

    Affected versions

    3.0.0
    3.0.0-beta1
    3.0.0-alpha2
    3.0.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61608 | CVE-DB