Vulnerability Description
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/SolidInvoice/SolidInvoice/commit/864539182572e1a3b2d76999b030
- https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17
- https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-
- https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-
FAQ
What is CVE-2026-46622?
CVE-2026-46622 is a vulnerability with a CVSS score of 8.1 (HIGH). SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any ...
How severe is CVE-2026-46622?
CVE-2026-46622 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46622?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.