Medium severity5.9NVD Advisory· Published Oct 14, 2026

CVE-2026-110765

Description

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

Affected products

Flexprice/flexpricellm-create
Range: <=2.1.38

Patches

Vulnerability mechanics

References

github.com/flexprice/flexprice/blob/f27da32f84ee34bad4bf39a8d887af87fc3f30fc/internal/api/v1/webhook.gonvd
hackmd.io/@hieuPenguinnn/flexprice-quickbooks-webhook-signature-bypassnvd
www.vulncheck.com/advisories/flexprice-through-2.1.38-quickbooks-webhook-signature-verification-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000