PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-57418 BoldGrid CVE debrief

A Missing Authorization vulnerability was found in BoldGrid Client Invoicing by Sprout Invoices. This issue, tracked as CVE-2026-57418, allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability affects Client Invoicing by Sprout Invoices versions from n/a through <= 20.8.13. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. It is caused by a Missing Authorization issue in the BoldGrid Client Invoicing by Sprout Invoices plugin. The primary weakness associated with this vulnerability is CWE-862. Users of Client Invoicing by Sprout Invoices, especially those using versions up to 20.8.13, should be aware of this vulnerability and take necessary actions to secure their installations.

Vendor
BoldGrid
Product
Client Invoicing by Sprout Invoices
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-13
Original CVE updated
2026-07-13
Advisory published
2026-07-13
Advisory updated
2026-07-13

Who should care

Users of Client Invoicing by Sprout Invoices, especially those using versions up to 20.8.13, should be aware of this vulnerability and take necessary actions to secure their installations. This includes reviewing and adjusting access control configurations, monitoring for suspicious activity, and applying the latest patch or update.

Technical summary

The CVE-2026-57418 vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. It is caused by a Missing Authorization issue in the BoldGrid Client Invoicing by Sprout Invoices plugin. The vulnerability's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The primary weakness associated with this vulnerability is CWE-862. The vulnerability affects Client Invoicing by Sprout Invoices versions from n/a through <= 20.8.13. Limited details are available about the vulnerability's impact and affected scope.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could allow unauthorized access to sensitive information.

Recommended defensive actions

  • Apply the latest patch or update for Client Invoicing by Sprout Invoices to version 20.8.14 or later.
  • Review and adjust access control configurations to ensure proper authorization levels.
  • Monitor for any suspicious activity related to the plugin.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-13T10:16:35.720Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited details are available about the vulnerability's impact and affected scope. The evidence is based on the CVE record and NVD entry, which provide limited information about the vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-13T10:16:35.720Z and has not been modified since then. The NVD entry is currently in the 'Received' status.