CVE-2026-46622: SolidInvoice API Token Plaintext Storage Vulnerability

Technical summary

CVE-2026-46622 is a cleartext storage vulnerability (CWE-312) affecting SolidInvoice versions prior to 2.3.17. API tokens, which serve as the primary authentication mechanism for all REST API requests, are persisted unencrypted in the api_tokens database table. An attacker with database read access obtains valid, immediately usable credentials for all API-authenticated accounts. The attack requires no brute-force, no cryptographic bypass, and no further exploitation steps once database access is achieved. Patch is available in version 2.3.17.

Business impact

Compromise of API tokens enables unauthorized API access on behalf of legitimate users. Attackers can invoke any API endpoint available to those user accounts—creating invoices, modifying financial records, exporting customer data, or integrating with downstream accounting systems. The severity depends on what your SolidInvoice instance exposes via API and which user accounts are active. In multi-tenant or shared deployments, a single database breach exposes credentials for all organizations and users. Remediation complexity increases if your deployment uses database replicas or automated backups that may contain stale but valid tokens.

Affected systems

All installations of SolidInvoice prior to version 2.3.17 are affected. The vulnerability exists in the core API authentication mechanism, so any deployment exposing the REST API is at risk. Open-source deployments are particularly vulnerable because source-code availability may aid reconnaissance, and self-hosted instances often lack centralized patching discipline. Managed or cloud-hosted SolidInvoice services are affected unless the provider has already upgraded to 2.3.17 or later.

Exploitability

Exploitability is contingent on database access. The vulnerability itself requires no active network interaction or application-layer attack; it is purely a storage issue. However, obtaining database access in the first place is the prerequisite. Common paths include unpatched SQL injection in the SolidInvoice application itself or its dependencies, misconfigured database network exposure, leaked or compromised database credentials, or insider access. Once database read access is gained, token theft is trivial and undetectable via standard application logging. The CVSS score of 8.1 (HIGH) reflects the high impact on confidentiality and integrity given that a database breach is assumed as the precondition.

Remediation

Upgrade SolidInvoice to version 2.3.17 or later. The patch implements encrypted storage for API tokens, rendering plaintext theft ineffective. After upgrading, rotate all existing API tokens to ensure old plaintext tokens cannot be reused even if database backups or replicas containing them are later compromised. Review database access logs and backup inventories for evidence of unauthorized database access during the window of vulnerability. If your deployment uses replicated databases or archived backups, ensure those are updated or securely disposed of after the token rotation is complete.

Patch guidance

Upgrade to SolidInvoice version 2.3.17 or later. The patch changes how API tokens are stored and should be applied as soon as feasible, particularly for instances exposed to untrusted networks or handling sensitive financial data. Test the upgrade in a non-production environment first to confirm compatibility with your specific configuration, plugins, and integrations. Schedule the upgrade during a maintenance window to minimize disruption; the patch does not require database schema changes beyond token re-encryption. After upgrade completion, trigger a forced re-authentication or token refresh cycle for all API consumers to ensure they obtain new encrypted tokens.

Detection guidance

Review database access logs from the vulnerability window (before your upgrade date) for unauthorized queries against the api_tokens table or bulk exports of the table contents. Check for SQL injection attempts in application logs or WAF logs that target authentication or token endpoints. Audit API logs for unusual token usage patterns—requests from unexpected IP addresses, simultaneous logins from multiple locations, or API calls inconsistent with known consumer applications. If you suspect database compromise, assume API tokens are exposed and revoke all active tokens, forcing re-authentication. Monitor for leaked credentials in public code repositories, paste sites, or dark-web marketplaces using your organization name and API token patterns.

Why prioritize this

This vulnerability should be treated as HIGH priority because it converts database compromise—a plausible attack outcome—into immediate API authentication compromise with no additional attacker effort. Database breaches occur frequently via SQL injection, misconfiguration, or insider threats; the lack of encryption amplifies their impact. The fix is straightforward (upgrade and rotate tokens), so delaying creates unnecessary risk. Organizations running older SolidInvoice versions should prioritize patching over other network-level hardening until this is resolved.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a HIGH severity assessment with these factors: Attack Vector NETWORK (the database is often network-accessible), Attack Complexity LOW (no special conditions needed once database access is obtained), Privileges Required LOW (the assumption that an attacker has gained some level of database access), User Interaction NONE (no user action required), Scope UNCHANGED (impact is limited to the SolidInvoice application), Confidentiality HIGH (all API tokens are exposed), Integrity HIGH (compromised tokens allow unauthorized modifications), Availability NONE (the attack does not disrupt service). The score emphasizes that database read access is the precondition; however, because database compromises are common and tokens become immediately actionable, the overall risk to an organization running unpatched SolidInvoice is substantial.

Frequently asked questions