CVE-2026-46622

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.

• CWE-312

• https://github.com/SolidInvoice/SolidInvoice/commit/864539182572e1a3b2d76999b03060661ffa00f1
• https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17
• https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq
• https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq

Published

Jun 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46616Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.…6.1
• CVE-2026-46617Fission is an open-source, Kubernetes-native serverless fram…8.7
• CVE-2026-46618Fission is an open-source, Kubernetes-native serverless fram…6.9
• CVE-2026-4662The JetEngine plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-46620e107 is a content management system (CMS). Prior to 2.3.5, e…6.5
• CVE-2026-46621Yamcs is a mission control framework. Prior to 5.12.7, the Y…9.1
• CVE-2026-46624Twenty is an open source CRM. From 1.7.7 through 1.16.7, a c…9.9
• CVE-2026-46625JavaScript Cookie is a JavaScript API for handling cookies, …7.5
• CVE-2026-46627Twig is a template language for PHP. Prior to 3.26.0, the Tw…6.5
• CVE-2026-46628Twig is a template language for PHP. Prior to 3.26.0, the de…5.4
• CVE-2026-46629Twig is a template language for PHP. Prior to 3.26.0, twig/i…6.5
• CVE-2026-4663Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…