CVE-2026-82029 · Package
NO FIX YET · SEE WHAT TO DO
Invoice Ninja before 5.13.28 lets an authenticated vendor-portal contact read invoices, contracts, receipts and expense files belonging to other vendors and clients. The document download endpoints check only the company, not the vendor, and the document IDs are predictable because the default HASH_SALT is empty.
first public Nov 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Companies that self-host Invoice Ninja at a version before 5.13.28 and use the vendor portal are exposed. An attacker needs a vendor-portal contact account to exploit it. Deployments on a version at or above 5.13.28, or with the vendor portal unused, are not affected per the sources' version range; the sources do not say whether a non-empty HASH_SALT changes exposure.
Not affected if no-vendor-portal, version-5.13.28-or-later
Who cares invoice-ninja, self-hosted, vendor-portal
5.13.28.HASH_SALT is set to a non-empty value in the environment configuration.5.13.28 or later.Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.
This page as .md · .json · in your agent: get_signal("CVE-2026-82029") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.