CVE-2026-83743

MediumCVSS 6.3/10Last modified Sep 1, 2026

Description

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-837444.3A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHoCVE-2026-837458.7Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and CVE-2026-837468.1Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.CVE-2026-837475.5Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally.CVE-2026-837489.8Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.CVE-2026-837497.0Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.CVE-2026-837507.0Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2026-837517.0Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-837527.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-837537.8Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.CVE-2026-837547.5Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.CVE-2026-837555.5Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-83743: Medium severity, CVSS 6.3 | Vulnix