{"action":"Upgrade solidinvoice/solidinvoice to 2.3.16 or later.","affected":[{"fixed":"2.3.16","introduced":"0"}],"component":"solidinvoice/solidinvoice","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.3.16"],"ghsa_id":"GHSA-7vfx-4246-jcfh","id":"tcs_01M5KEYDW0502E7KSZBHGHM421","modified_at":"2026-09-10T03:50:49.071803315Z","published_at":"2026-06-26T22:20:50Z","references":["https://osv.dev/vulnerability/GHSA-7vfx-4246-jcfh","https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-7vfx-4246-jcfh","https://github.com/SolidInvoice/SolidInvoice"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-7vfx-4246-jcfh","url":"https://osv.dev/vulnerability/GHSA-7vfx-4246-jcfh"}],"summary":"SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings"}