High severity8.1NVD Advisory· Published Jun 11, 2026· Updated Jun 15, 2026
CVE-2026-46622
CVE-2026-46622
Description
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.3.17
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.