Description
An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components
Published: 2026-09-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Apply Fix
AI Analysis

Impact

An issue in Invoice Ninja version 5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components.

Affected Systems

The vulnerability impacts only Invoice Ninja, specifically the 5.13.24 release, with no other vendors or product versions listed as affected.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while an EPSS score of < 1 % suggests a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog, so no confirmed exploits have been reported. The likely attack vector is delivery of a crafted webhook payload from an external source to the vulnerable endpoints, causing the application to fetch and return data from internal resources. Despite the low EPSS, the potential confidentiality impact warrants prompt attention.

Generated by OpenCVE AI on September 10, 2026 at 03:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a newer release of Invoice Ninja that contains the webhook SSRF fix.
  • If an upgrade is not immediately feasible, modify the webhook processing code to reject URLs that resolve to private, internal, or loopback addresses.
  • Restrict outbound HTTP traffic from the web server to only the domains required for legitimate webhook operations, using firewall rules or proxy whitelists.

Generated by OpenCVE AI on September 10, 2026 at 03:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title SSRF via Webhook Processing in Invoice Ninja 5.13.24

Tue, 08 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Title Invoice Ninja API Webhook SSRF Vulnerability
Weaknesses CWE-918

Tue, 08 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 05 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Invoiceninja
Invoiceninja invoice Ninja
Vendors & Products Invoiceninja
Invoiceninja invoice Ninja

Fri, 04 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Invoice Ninja API Webhook SSRF Vulnerability
Weaknesses CWE-200
CWE-918

Fri, 04 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components
References

Subscriptions

Invoiceninja Invoice Ninja
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-08T14:21:34.264Z

Reserved: 2026-08-07T00:00:00.000Z

Link: CVE-2026-71626

cve-icon Vulnrichment

Updated: 2026-09-08T14:20:58.238Z

cve-icon NVD

Status : Deferred

Published: 2026-09-04T20:17:26.413

Modified: 2026-09-09T16:04:24.933

Link: CVE-2026-71626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T04:00:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor