Threats tagged 'ghsa-35wr-7cjw-8mx6'

Invoice Ninja versions before 5.13.28 have a broken access control vulnerability that allows authenticated vendor-portal users to access documents of other vendors and clients. This occurs because authorization checks validate only company_id scope instead of verifying vendor ownership. Attackers can exploit predictable sequential Hashids document identifiers due to a default empty HASH_SALT to download invoice PDFs, contracts, payment receipts, and expense attachments belonging to other vendors within the same company.