CVE-2026-110765 FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
Unauthenticated attackers can bypass webhook signature verification to forge payment notifications, marking invoices as paid or overpaid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110765?
CVE-2026-110765 is a high-severity authentication bypass vulnerability in flexprice, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
Weakness: CWE-347
Which versions are affected by CVE-2026-110765?
How do I fix CVE-2026-110765?
No fix has been published for CVE-2026-110765 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-110765 being exploited?
There is no known exploitation of CVE-2026-110765 in the wild and no public exploit code.
Sources
Also known as GHSA-mc76-h4x2-pgj7.