CVE-2026-46622: SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach

Synopsis

This is a plaintext credential storage vulnerability in SolidInvoice, an open-source invoicing platform. The vulnerability is reachable over the network and requires a low-privilege account, meaning any attacker who gains read access to the database (via SQL injection, a leaked backup, a misconfigured replica, or insider access) immediately obtains all API tokens for every user in plaintext with no decryption or cracking step required. Successful exploitation gives the attacker full API credentials, enabling them to read and tamper with any data exposed by the REST API. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application over the network; the CVSS vector specifies AV:N, meaning no physical or local access is assumed.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker needs any valid credential to reach attack vectors such as SQL injection entry points, but does not need administrative rights.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or specific environmental configuration.

Blast Radius

• Reads all plaintext API tokens from the database for every user account registered in the application.
• Uses harvested tokens to authenticate to the SolidInvoice REST API as any user, reading invoices, client records, and financial data.
• Modifies or deletes invoices, payment records, and client data through the API using the stolen credentials.