{"id":"CVE-2026-82029","kind":"vulnerability","aliases":["CVE-2026-82029"],"related":[],"title":"Invoice Ninja: vendor portal users can download other vendors' documents","description":"Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.","summary":"Invoice Ninja before 5.13.28 lets an authenticated vendor-portal contact read invoices, contracts, receipts and expense files belonging to other vendors and clients. The document download endpoints check only the company, not the vendor, and the document IDs are predictable because the default HASH_SALT is empty.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["invoice-ninja","package","self-hosted","vendor-portal"],"not_affected_if":["no-vendor-portal","version-5.13.28-or-later"],"how_to_check":"- Look at the Invoice Ninja version in the deployment, for example in the application's package or release metadata, and compare it with `5.13.28`.\n- Check whether the vendor portal is enabled for the company and whether vendor contacts can log in.\n- Check whether `HASH_SALT` is set to a non-empty value in the environment configuration.","fix":"- Invoice Ninja: upgrade to `5.13.28` or later.","status":"open","published_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:11+00:00","updated_at":"2026-11-04T19:30:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T19:30:11Z","model":"claude-haiku-5-5","output":{"fix":"- Invoice Ninja: upgrade to `5.13.28` or later.","reach":"internet","title":"Invoice Ninja: vendor portal users can download other vendors' documents","impact":"medium","summary":"Invoice Ninja before 5.13.28 lets an authenticated vendor-portal contact read invoices, contracts, receipts and expense files belonging to other vendors and clients. The document download endpoints check only the company, not the vendor, and the document IDs are predictable because the default HASH_SALT is empty.","audience":"businesses","category":"package","nicknames":[],"who_cares":["invoice-ninja","self-hosted","vendor-portal"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other vendors' and clients' invoices, contracts and receipts","analyst_note":"Confirm from the NVD or vendor release notes whether a non-empty HASH_SALT is required for exposure and whether vendor-portal is default-enabled.","how_to_check":"- Look at the Invoice Ninja version in the deployment, for example in the application's package or release metadata, and compare it with `5.13.28`.\n- Check whether the vendor portal is enabled for the company and whether vendor contacts can log in.\n- Check whether `HASH_SALT` is set to a non-empty value in the environment configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["no-vendor-portal","version-5.13.28-or-later"],"who_is_affected":"Companies that self-host Invoice Ninja at a version before 5.13.28 and use the vendor portal are exposed. An attacker needs a vendor-portal contact account to exploit it. Deployments on a version at or above 5.13.28, or with the vendor portal unused, are not affected per the sources' version range; the sources do not say whether a non-empty HASH_SALT changes exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4269,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82029':13A,16A '/download':121C '/vendor/documents':119C '/vendor/documents/download_multiple':124C '5.13.28':30B,78C 'access':82C,93C 'allow':86C 'attach':148C 'attack':115C 'authent':33B,87C 'author':103C 'belong':45B,95C 'broken':81C 'check':55B,104C 'client':50B,100C 'compani':58B,108C,151C 'contact':37B,91C 'contain':79C 'contract':40B,143C 'control':83C 'cve':11A,14A 'default':70B,134C 'document':10A,52B,64B,94C,129C 'download':7A,53B 'due':131C 'empti':74B,135C 'endpoint':54B 'enumer':125C 'expens':43B,147C 'exploit':102C 'file':44B 'get':118C 'hash':71B,136C 'hashid':120C,128C 'host':23B 'id':65B,109C 'identifi':130C 'instead':111C 'invoic':1A,18B,27B,39B,75C,141C 'invoice-ninja':17B 'let':31B 'ninja':2A,19B,28B,76C 'ownership':114C 'packag':20B 'payment':144C 'pdfs':142C 'portal':4A,26B,36B,90C 'post':123C 'predict':67B,126C 'read':38B,139C 'receipt':41B,145C 'request':117C 'salt':72B,137C 'scope':110C 'self':22B 'self-host':21B 'sequenti':127C 'user':5A 'valid':106C 'vendor':3A,9A,25B,35B,48B,61B,89C,98C,113C 'vendor-port':24B,34B,88C 'vulner':84C 'within':149C","nicknames":[],"mitigations":[],"who_affected":"Companies that self-host Invoice Ninja at a version before 5.13.28 and use the vendor portal are exposed. An attacker needs a vendor-portal contact account to exploit it. Deployments on a version at or above 5.13.28, or with the vendor portal unused, are not affected per the sources' version range; the sources do not say whether a non-empty HASH_SALT changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","invoiceninja","package","selfhosted","vendorportal"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82029","severity":null,"published_at":"2026-11-04T19:17:41+00:00","modified_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null}],"documents":[{"id":69749,"url":"https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69750,"url":"https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":69751,"url":"https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}