CVE-2026-29925
Published: 30 March 2026
Summary
CVE-2026-29925 is a high-severity SSRF (CWE-918) vulnerability in Invoiceninja Invoice Ninja. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-29925 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, affecting Invoice Ninja versions v5.12.46 and v5.12.48 in the CheckDatabaseRequest.php component. Published on 2026-03-30, it carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), highlighting its network-accessible nature, low attack complexity, requirement for low privileges, lack of user interaction, changed scope, and high confidentiality impact with no integrity or availability effects.
A low-privileged authenticated user can exploit this SSRF over the network with low complexity and no user interaction. Exploitation enables the attacker to manipulate the server into initiating unauthorized requests, potentially resulting in high confidentiality impacts such as disclosure of sensitive internal data or access to resources behind firewalls.
Key references include a GitHub gist at https://gist.github.com/TrekLaps/5b2c72106d950dab0cd1897eb93200f1 and the vulnerable source code at https://github.com/invoiceninja/invoiceninja/blob/v5-stable/app/Http/Requests/Setup/CheckDatabaseRequest.php, which security practitioners should review for details on the issue and potential mitigations like input validation or upgrades beyond the affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17150
Vulnerability details
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing web app (Invoice Ninja) is directly exploited via T1190; the ability to force arbitrary outbound requests from the server enables internal network/port probing consistent with T1046.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SSRF by validating user-supplied inputs in CheckDatabaseRequest.php to prevent unauthorized server-initiated requests.
Remediates the specific SSRF flaw in Invoice Ninja v5.12.46 and v5.12.48 through timely patching or upgrades.
Enforces boundary protections like firewalls or proxies to restrict outbound requests from the vulnerable application to unauthorized internal resources.