SolidInvoice stored API tokens as raw text in the database before version 2.3.17. The consequence is that any party who gains read access to the database—via SQL injection, a leaked backup, a misconfigured replica, or insider access—will obtain every user’s API credentials with no additional effort. This disclosure allows an attacker to authenticate as any user and therefore access, modify, or delete any invoicing data and perform administrative actions.

The vulnerability affects the SolidInvoice invoicing platform, all releases before 2.3.17. Users running SolidInvoice version 2.3.17 or later are no longer impacted because the issue has been corrected.

The CVSS score of 8.1 classifies this flaw as High severity. The EPSS score is not available, but the lack of a KEV listing does not reduce the risk because the attack only requires database read permission, which is a common privilege. An attacker who compromises the database can immediately harvest API tokens, which turns the breach into a comprehensive compromise of the platform. Even without a direct code execution path, the impact on confidentiality, integrity, and availability is substantial if the tokens empower remote API access.