CVE-2026-83743: Invoice Ninja Auth Bypass Vulnerability

CVE-2026-83743 Overview

CVE-2026-83743 is an authorization bypass vulnerability in Invoice Ninja versions up to and including 5.13.26. The flaw resides in the Vendor Portal Profile Update component at /vedor/profile/, where the vendor_contact argument can be manipulated to bypass access controls. An authenticated vendor user can modify contact records belonging to other vendors, resulting in an Insecure Direct Object Reference (IDOR) condition [CWE-285]. The issue was resolved in Invoice Ninja 5.13.27 via commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90, which introduces a dedicated authorization request class. A public write-up describing the exploitation path is available.

Critical Impact
Authenticated vendors can read and modify contact data belonging to other vendor accounts through IDOR manipulation of the vendor_contact parameter.

Affected Products

Invoice Ninja versions up to and including 5.13.26
Component: Vendor Portal Profile Update (/vedor/profile/)
Fixed in Invoice Ninja 5.13.27

Discovery Timeline

2026-09-01 - CVE-2026-83743 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83743

Vulnerability Analysis

The vulnerability is a broken access control issue in the Invoice Ninja Vendor Portal. The VendorContactController responsible for handling vendor profile updates accepted a generic Illuminate\Http\Request without validating that the authenticated vendor owned the target contact identifier supplied in the request. As a result, an authenticated vendor could substitute another vendor's contact identifier in the vendor_contact argument and modify records outside their own scope.

Because the endpoint is reachable over the network and requires only low-privileged vendor credentials, exploitation is straightforward. The impact is limited to confidentiality and integrity of vendor contact records, but successful exploitation enables horizontal privilege abuse across tenants sharing the same Invoice Ninja deployment.

Root Cause

The controller method lacked an authorization layer verifying that the URL segment identifying the vendor contact matched the currently authenticated vendor. Ownership was assumed rather than enforced, which is the classic pattern behind Insecure Direct Object Reference vulnerabilities.

Attack Vector

An attacker with valid vendor portal credentials sends a crafted request to /vedor/profile/{other_vendor_contact_id} with modified body parameters. The server processes the update against the referenced contact without checking ownership, allowing the attacker to alter another vendor's profile data.

php

// Patch: app/Http/Controllers/VendorPortal/VendorContactController.php
 namespace App\Http\Controllers\VendorPortal;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\VendorPortal\UpdateVendorContactRequest;
 use App\Models\VendorContact;
 use App\Utils\Traits\MakesHash;
-use Illuminate\Http\Request;
 
 class VendorContactController extends Controller
 {

Source: GitHub Commit f86fd96

php

// Patch: app/Http/Requests/VendorPortal/UpdateVendorContactRequest.php
<?php

namespace App\Http\Requests\VendorPortal;

use App\Http\Requests\Request;
use App\Utils\Traits\MakesHash;

class UpdateVendorContactRequest extends Request
{
    use MakesHash;

    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize(): bool
    {
        return $this->encodePrimaryKey(auth()->guard('vendor')->user()->id) === request()->segment(3);
    }
}

The fix introduces UpdateVendorContactRequest, whose authorize() method compares the encoded primary key of the authenticated vendor to the URL segment before permitting the update. Source: GitHub Commit f86fd96.

Detection Methods for CVE-2026-83743

Indicators of Compromise

HTTP PUT or POST requests to /vedor/profile/ where the trailing identifier segment does not match the authenticated vendor's encoded primary key.
Vendor contact records showing unexpected changes to fields such as email, phone, or name without corresponding legitimate activity in application logs.
Multiple sequential requests from a single vendor session iterating through vendor contact identifiers.

Detection Strategies

Review web server and Laravel application logs for /vedor/profile/ requests and correlate the URL segment with the authenticated session identity.
Alert on any vendor session that issues profile update requests targeting more than one contact identifier within a short window.
Enable database-level auditing on vendor contact tables to capture unauthorized mutations for forensic review.

Monitoring Recommendations

Ingest Invoice Ninja application and access logs into a centralized SIEM for correlation across vendor sessions.
Baseline normal vendor profile update behavior and flag deviations such as cross-tenant identifier access.
Track version telemetry across Invoice Ninja deployments to identify hosts still running 5.13.26 or earlier.

How to Mitigate CVE-2026-83743

Immediate Actions Required

Upgrade Invoice Ninja to version 5.13.27 or later, which includes commit f86fd9697ce7bd0d28adbe2e6c5890780482ea90.
Audit vendor contact records for unauthorized modifications made prior to patching.
Rotate vendor portal credentials if evidence of abuse is discovered during audit.

Patch Information

The vendor-supplied fix is available in Invoice Ninja Release v5.13.27. The patch adds the UpdateVendorContactRequest form request class, which enforces ownership by comparing the encoded authenticated vendor identifier against the URL segment before authorizing the update. Additional analysis is documented in the Blog Post on IDOR in Invoice Ninja Vendor Portal and tracked in VulDB CVE-2026-83743.

Workarounds

Restrict access to the vendor portal by IP allowlist until patching is complete.
Temporarily disable vendor self-service profile updates via web server rules blocking /vedor/profile/ if the endpoint is not business-critical.
Increase logging verbosity on vendor portal routes to detect exploitation attempts pending upgrade.

bash

# Upgrade Invoice Ninja to the patched release
cd /path/to/invoiceninja
git fetch --tags
git checkout v5.13.27
php artisan optimize:clear
php artisan config:cache