Broken Access Control in Invoice Ninja by Invoice Ninja

CVE-2026-82029

What is CVE-2026-82029?

Invoice Ninja versions prior to 5.13.28 have a vulnerability due to improper access controls that enable authenticated vendor-portal users to access documents not owned by them. This flaw arises from authorization checks that validate only the company_id, rather than verifying vendor ownership. By leveraging predictable Hashids document identifiers, attackers can exploit the system to gain unauthorized access to sensitive documents such as invoices, contracts, payment receipts, and expense attachments.

References