Medium severity5.9NVD Advisory· Published Sep 4, 2026· Updated Sep 4, 2026
CVE-2026-61614
CVE-2026-61614
Description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.0.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.