CVE-2026-83744: Server-Side Request Forgery in invoiceninja Invoice Ninja

This vulnerability affects Invoice Ninja versions up to 5.13.26 in the Purify::isHostSafe function of the invoices endpoint. By manipulating the 'notes' parameter, an attacker can cause the server to make unintended requests to internal or external resources, resulting in server-side request forgery. The vulnerability is remotely exploitable without user interaction and requires low privileges. The vendor was notified but has not issued any patch or official remediation guidance. No known exploits in the wild have been reported.

Successful exploitation allows an attacker to induce the server to send crafted requests to arbitrary hosts, potentially accessing internal services or sensitive information not otherwise accessible. This can lead to information disclosure or further attacks leveraging internal network access. The medium CVSS score reflects the moderate impact and ease of exploitation without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level protections such as restricting outbound requests from the Invoice Ninja server to trusted destinations. Monitoring and filtering inputs to the 'notes' parameter may reduce risk but is not a complete mitigation.