# GHSA-7vfx-4246-jcfh: Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to acces

> Authenticated users can access or modify other users' API tokens and notification settings due to missing ownership checks in Symfony LiveComponent actions.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 26 Jun 2026

## What is GHSA-7vfx-4246-jcfh?

GHSA-7vfx-4246-jcfh is a missing authorization vulnerability in solidinvoice/solidinvoice, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

## Summary

Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or delete other users' API tokens and notification transport settings. The root cause is that LiveComponent actions accept entity IDs without verifying ownership, while the listing methods correctly filter by user.

## Findings

### 1. Cross-User API Token Revocation (MEDIUM)

**File:** `src/UserBundle/Twig/Components/ApiTokens.php`, lines 50-55

The `revoke()` LiveAction accepts any `ApiToken` via `#[LiveArg]` without checking ownership. The `apiTokens()` method correctly filters by user (`getApiTokensForUser($this->security->getUser())`).

```php
#[LiveAction]
public function revoke(#[LiveArg] ApiToken $token): void
{
    $this->apiTokenRepository->revoke($token); // No ownership check
}
```

### 2. Cross-User API Token History Disclosure (MEDIUM)

**File:** `src/UserBundle/Twig/Components/ApiTokenHistory.php`, lines 30-55

The writable `$token` LiveProp performs `$this->apiTokenRepository->find($this->token)` without user verification. Exposes IP addresses, request methods, paths, and user agents from other users' API token usage.

### 3. Cross-User Notification Transport Settings Disclosure (HIGH)

**File:** `src/NotificationBundle/Twig/Components/NotificationIntegrations.php`, lines 48-55

The `integration()` method performs `$this->repository->find($this->setting)` using a writable LiveProp without user check. The `enabledIntegrations()` method correctly filters: `$this->repository->findBy(['user' => $this->getUser()])`.

The `TransportSetting` entity stores notification credentials in a JSON `settings` column, potentially exposing API keys for Slack, Discord, Telegram, or SMS services.

### 4. Cross-User Notification Transport Setting Takeover (HIGH)

**File:** `src/NotificationBundle/Twig/Components/NotificationTransportConfiguration.php`, lines 39-40, 84-101

The writable `$setting` LiveProp accepts any `TransportSetting` entity. The `save()` action overwrites the user field with the current user via `$setting->setUser($user)`, effectively stealing the transport configuration and its stored credentials.

## Root Cause

The application relies on Doctrine's `CompanyFilter` for tenant isolation but has no user-level access controls within a company. LiveComponent actions that resolve entities from client-provided IDs don't verify ownership.

## Suggested Fix

Add user ownership verification in each LiveAction/LiveProp before performing operations:
```php
if ($token->getUser() !== $this->security->getUser()) {
    throw $this->createAccessDeniedException();
}
```

## Which versions are affected by GHSA-7vfx-4246-jcfh?

2 open source packages ship an affected version, including solidinvoice/solidinvoice.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `solidinvoice/solidinvoice` | Packagist | All versions | 2.3.16 |
| `solidinvoice/solidinvoice` | Packagist | All versions | 2.3.16 |

## How do I fix GHSA-7vfx-4246-jcfh?

Upgrade solidinvoice/solidinvoice to 2.3.16 or later.

## Is GHSA-7vfx-4246-jcfh being exploited?

There is no known exploitation of GHSA-7vfx-4246-jcfh in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-7vfx-4246-jcfh and fix it if it is affected.

What it is: GHSA-7vfx-4246-jcfh is a missing authorization vulnerability in solidinvoice/solidinvoice, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-7vfx-4246-jcfh in the wild and no public exploit code.

Affected packages and fixed versions:
- solidinvoice/solidinvoice (Packagist): affected all versions; fixed in 2.3.16
- solidinvoice/solidinvoice (Packagist): affected all versions; fixed in 2.3.16

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/ (Markdown: https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-7vfx-4246-jcfh

---
From sbomify Insights: https://insights.sbomify.com/GHSA-7vfx-4246-jcfh/
Summaries are generated and may contain mistakes; the official description above is the record.