CVE-2026-108047

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

EUVD-2026-115796

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

CVE-2026-108047 Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

CVE-2026-108047

Alosuite contains an inadequate authorization vulnerability within its user invitation functionality, specifically affecting the /Requests/userInvitation endpoint. The root cause is a failure to properly validate privilege assignments on the server side during the request process. An unauthentica...

CVE-2026-61608

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, "UserInvitation" entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a...

EUVD-2026-71622

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...

CVE-2026-61608: Insufficient Session Expiration

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...