CVE-2026-82029

    Dashboard / Vulnerabilities / CVE-2026-82029

    CVE-2026-82029

    Published: 4 Nov 2026Last Modified: 7 Nov 2026

    Summary: Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

    Details: Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82029.json, https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28, https://nvd.nist.gov/vuln/detail/CVE-2026-82029, https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal, https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1, https://github.com/invoiceninja/invoiceninja

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -99e9a7a9b5d4c0b91134dd4acc44bb2deac5d5f7

    Affected versions

    v5.13.27
    v5.13.26
    v5.13.25
    v5.13.24
    v5.13.23
    v5.13.22
    v5.13.21
    v5.13.20
    v5.13.19
    v5.13.18
    v5.13.17
    v5.13.16
    v5.13.15
    v5.13.14
    v5.13.13
    v5.13.12
    v5.13.11
    v5.13.10
    v5.13.9
    v5.13.8
    v5.13.7
    v5.13.6
    v5.13.5
    v5.13.4
    v5.13.3
    v5.13.2
    v5.13.1
    v5.13.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-82029 | CVE-DB