{"answers":{"affected":"2 open source packages ship an affected version, including solidinvoice/solidinvoice.","exploited":"There is no known exploitation of GHSA-7vfx-4246-jcfh in the wild and no public exploit code.","fix":"Upgrade solidinvoice/solidinvoice to 2.3.16 or later.","what":"GHSA-7vfx-4246-jcfh is a missing authorization vulnerability in solidinvoice/solidinvoice, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-7vfx-4246-jcfh and fix it if it is affected.\n\nWhat it is: GHSA-7vfx-4246-jcfh is a missing authorization vulnerability in solidinvoice/solidinvoice, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-7vfx-4246-jcfh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- solidinvoice/solidinvoice (Packagist): affected all versions; fixed in 2.3.16\n- solidinvoice/solidinvoice (Packagist): affected all versions; fixed in 2.3.16\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/ (Markdown: https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/index.md)","id":"GHSA-7vfx-4246-jcfh","markdown":"https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/index.md","name":"GHSA-7vfx-4246-jcfh","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"SolidInvoice","requires_auth":"low_privilege","summary":"Authenticated users can access or modify other users' API tokens and notification settings due to missing ownership checks in Symfony LiveComponent actions.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nFour authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or delete other users' API tokens and notification transport settings. The root cause is that LiveComponent actions accept entity IDs without verifying ownership, while the listing methods correctly filter by user.\n\n## Findings\n\n### 1. Cross-User API Token Revocation (MEDIUM)\n\n**File:** `src/UserBundle/Twig/Components/ApiTokens.php`, lines 50-55\n\nThe `revoke()` LiveAction accepts any `ApiToken` via `#[LiveArg]` without checking ownership. The `apiTokens()` method correctly filters by user (`getApiTokensForUser($this-\u003esecurity-\u003egetUser())`).\n\n```php\n#[LiveAction]\npublic function revoke(#[LiveArg] ApiToken $token): void\n{\n    $this-\u003eapiTokenRepository-\u003erevoke($token); // No ownership check\n}\n```\n\n### 2. Cross-User API Token History Disclosure (MEDIUM)\n\n**File:** `src/UserBundle/Twig/Components/ApiTokenHistory.php`, lines 30-55\n\nThe writable `$token` LiveProp performs `$this-\u003eapiTokenRepository-\u003efind($this-\u003etoken)` without user verification. Exposes IP addresses, request methods, paths, and user agents from other users' API token usage.\n\n### 3. Cross-User Notification Transport Settings Disclosure (HIGH)\n\n**File:** `src/NotificationBundle/Twig/Components/NotificationIntegrations.php`, lines 48-55\n\nThe `integration()` method performs `$this-\u003erepository-\u003efind($this-\u003esetting)` using a writable LiveProp without user check. The `enabledIntegrations()` method correctly filters: `$this-\u003erepository-\u003efindBy(['user' =\u003e $this-\u003egetUser()])`.\n\nThe `TransportSetting` entity stores notification credentials in a JSON `settings` column, potentially exposing API keys for Slack, Discord, Telegram, or SMS services.\n\n### 4. Cross-User Notification Transport Setting Takeover (HIGH)\n\n**File:** `src/NotificationBundle/Twig/Components/NotificationTransportConfiguration.php`, lines 39-40, 84-101\n\nThe writable `$setting` LiveProp accepts any `TransportSetting` entity. The `save()` action overwrites the user field with the current user via `$setting-\u003esetUser($user)`, effectively stealing the transport configuration and its stored credentials.\n\n## Root Cause\n\nThe application relies on Doctrine's `CompanyFilter` for tenant isolation but has no user-level access controls within a company. LiveComponent actions that resolve entities from client-provided IDs don't verify ownership.\n\n## Suggested Fix\n\nAdd user ownership verification in each LiveAction/LiveProp before performing operations:\n```php\nif ($token-\u003egetUser() !== $this-\u003esecurity-\u003egetUser()) {\n    throw $this-\u003ecreateAccessDeniedException();\n}\n```","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to acces","id":"GHSA-7vfx-4246-jcfh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["2.3.16"],"introduced":["0"],"last_affected":[],"package":"solidinvoice/solidinvoice","purl":null,"source":"GHSA-7vfx-4246-jcfh"},{"ecosystem":"Packagist","fixed":["2.3.16"],"introduced":["0"],"last_affected":[],"package":"solidinvoice/solidinvoice","purl":"pkg:composer/solidinvoice/solidinvoice","source":"GHSA-7vfx-4246-jcfh"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can access or modify other users' API tokens and notification settings due to missing ownership checks in Symfony LiveComponent actions.","url":"https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/"}