CVE-2026-71626

Invoice Ninja v5.13.24 leaks sensitive information through its webhook handling components, specifically StoreWebhookRequest.php, UpdateWebhookRequest.php and WebhookSingle.php (CWE-200). Because the affected request-validation and single-webhook-view code paths are reachable over the network without authentication (CVSS: AV:N/AC:L/PR:N), a remote attacker can send crafted HTTP requests to webhook-related endpoints and read data that should not be disclosed. The flaw is confidentiality-only (CVSS 3.1 score 7.5 with C:H/I:N/A:N), so it does not permit data modification or service disruption. Any self-hosted or otherwise exposed Invoice Ninja deployment running version 5.13.24 is potentially affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade Invoice Ninja to the latest 5.x release newer than 5.13.24, which addresses the information exposure in the webhook components. If you cannot patch immediately, restrict network access to the application (firewall/VPN or reverse-proxy authentication) and review access logs for unauthenticated requests to webhook endpoints. Since only v5.13.24 is cited in the advisory, verify your deployed version before assuming exposure.