---
id: "CVE-2026-82029"
kind: "vulnerability"
aliases: ["CVE-2026-82029"]
title: "Invoice Ninja: vendor portal users can download other vendors' documents"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["invoice-ninja", "package", "self-hosted", "vendor-portal"]
not_affected_if: ["no-vendor-portal", "version-5.13.28-or-later"]
published_at: "2026-11-04T19:17:41+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:30:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82029", "first_seen_at": "2026-11-04T19:28:48+00:00"}]
---

# Invoice Ninja: vendor portal users can download other vendors' documents

Invoice Ninja before 5.13.28 lets an authenticated vendor-portal contact read invoices, contracts, receipts and expense files belonging to other vendors and clients. The document download endpoints check only the company, not the vendor, and the document IDs are predictable because the default HASH_SALT is empty.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look at the Invoice Ninja version in the deployment, for example in the application's package or release metadata, and compare it with `5.13.28`.
- Check whether the vendor portal is enabled for the company and whether vendor contacts can log in.
- Check whether `HASH_SALT` is set to a non-empty value in the environment configuration.

## Fix

- Invoice Ninja: upgrade to `5.13.28` or later.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82029

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal
- [fix] Patch: github.com https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1
- [fix] Release notes: github.com https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28

## From the sources

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_