The vulnerability allows a logged‑in user to access the API token request history of any other user in the same organization by altering two writable props on the Symfony UX LiveComponent DataGrid. This bypasses normal authorization checks (CWE‑639) and can expose information about API usage, credentials, and traffic patterns.

SolidInvoice open‑source invoicing platform versions prior to 3.0.1 are affected. Any deployment running 3.0.0 or earlier can be exploited. The vendor released a fix in release 3.0.1.

The CVSS score is 6.5, indicating a moderate severity. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Because the exploit requires authentication, an attacker must have legitimate credentials within the organization. Successful exploitation provides access to other users’ API token request histories, which could aid in further attacks.