SQL Injection Vulnerability in MATCHA INVOICE by ICZ
CVE-2026-24913

8.7HIGH

Key Information:

Vendor

Icz Corporation

Status
Matcha Invoice
Vendor
CVE Published:
8 April 2026

What is CVE-2026-24913?

A SQL Injection vulnerability has been identified in MATCHA INVOICE versions 2.6.6 and earlier, allowing an authenticated user to execute arbitrary SQL queries. This flaw could potentially lead to unauthorized access to or manipulation of sensitive data stored within the database. Implementing the recommended security practices is essential to mitigate risks associated with this vulnerability.

Affected Version(s)

MATCHA INVOICE 2.6.6 and earlier

References

https://oss.icz.co.jp/news/?p=1386
https://jvn.jp/en/jp/JVN33581068/

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.