CVE-2026-82029

Invoice Ninja versions prior to 5.13.28 are vulnerable to a broken access control flaw within the vendor portal. The root cause is that authorization checks validate the company_id scope instead of specific vendor ownership , allowing authenticated vendor-portal contacts to access documents belon...