CVE-2026-83743

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-83743

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83743.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-83743

Published

2026-09-01T04:30:16.344Z

Modified

2026-09-03T03:30:56.550339687Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

Details

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.

Database specific

{
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83743.json"
}

References

Affected packages

Git / github.com/invoiceninja/invoiceninja

Affected ranges

Type

GIT

Repo

https://github.com/invoiceninja/invoiceninja

Events

Introduced

936ff9cf3326b2774bc8dc0aa8fa1eca11ce5b20

Fixed

f86fd9697ce7bd0d28adbe2e6c5890780482ea90

Fixed

36f4a6b1c9cce12a63f9f19cd7bc28c6d9dcbe6c

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "5.13.0"
        },
        {
            "last_affected": "5.13.0"
        },
        {
            "introduced": "5.13.1"
        },
        {
            "last_affected": "5.13.1"
        },
        {
            "introduced": "5.13.2"
        },
        {
            "last_affected": "5.13.2"
        },
        {
            "introduced": "5.13.3"
        },
        {
            "last_affected": "5.13.3"
        },
        {
            "introduced": "5.13.4"
        },
        {
            "last_affected": "5.13.4"
        },
        {
            "introduced": "5.13.5"
        },
        {
            "last_affected": "5.13.5"
        },
        {
            "introduced": "5.13.6"
        },
        {
            "last_affected": "5.13.6"
        },
        {
            "introduced": "5.13.7"
        },
        {
            "last_affected": "5.13.7"
        },
        {
            "introduced": "5.13.8"
        },
        {
            "last_affected": "5.13.8"
        },
        {
            "introduced": "5.13.9"
        },
        {
            "last_affected": "5.13.9"
        },
        {
            "introduced": "5.13.10"
        },
        {
            "last_affected": "5.13.10"
        },
        {
            "introduced": "5.13.11"
        },
        {
            "last_affected": "5.13.11"
        },
        {
            "introduced": "5.13.12"
        },
        {
            "last_affected": "5.13.12"
        },
        {
            "introduced": "5.13.13"
        },
        {
            "last_affected": "5.13.13"
        },
        {
            "introduced": "5.13.14"
        },
        {
            "last_affected": "5.13.14"
        },
        {
            "introduced": "5.13.15"
        },
        {
            "last_affected": "5.13.15"
        },
        {
            "introduced": "5.13.16"
        },
        {
            "last_affected": "5.13.16"
        },
        {
            "introduced": "5.13.17"
        },
        {
            "last_affected": "5.13.17"
        },
        {
            "introduced": "5.13.18"
        },
        {
            "last_affected": "5.13.18"
        },
        {
            "introduced": "5.13.19"
        },
        {
            "last_affected": "5.13.19"
        },
        {
            "introduced": "5.13.20"
        },
        {
            "last_affected": "5.13.20"
        },
        {
            "introduced": "5.13.21"
        },
        {
            "last_affected": "5.13.21"
        },
        {
            "introduced": "5.13.22"
        },
        {
            "last_affected": "5.13.22"
        },
        {
            "introduced": "5.13.23"
        },
        {
            "last_affected": "5.13.23"
        },
        {
            "introduced": "5.13.24"
        },
        {
            "last_affected": "5.13.24"
        },
        {
            "introduced": "5.13.25"
        },
        {
            "last_affected": "5.13.25"
        },
        {
            "introduced": "5.13.26"
        },
        {
            "last_affected": "5.13.26"
        }
    ]
}

Affected versions

5.*

5.13.0

5.13.1

5.13.10

5.13.11

5.13.12

5.13.13

5.13.14

5.13.15

5.13.16

5.13.17

5.13.18

5.13.19

5.13.2

5.13.20

5.13.21

5.13.22

5.13.23

5.13.24

5.13.25

5.13.26

5.13.3

5.13.4

5.13.5

5.13.6

5.13.7

5.13.8

5.13.9

v5.*

v5.13.0

v5.13.1

v5.13.10

v5.13.11

v5.13.12

v5.13.13

v5.13.14

v5.13.15

v5.13.16

v5.13.17

v5.13.18

v5.13.19

v5.13.2

v5.13.20

v5.13.21

v5.13.22

v5.13.23

v5.13.24

v5.13.25

v5.13.26

v5.13.3

v5.13.4

v5.13.5

v5.13.6

v5.13.7

v5.13.8

v5.13.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83743.json"