CVE-2026-71233 invoiceninja CVE debrief

Who should care

Users of InvoiceNinja v5-stable, particularly those with access to invoice creation, should be aware of this vulnerability and take steps to mitigate it. Operators of affected systems should review and sanitize user-input terms field data, implement HTML sanitization for terms field rendering, restrict access to invoice creation to authorized users, and monitor for suspicious activity on client accounts. Security teams should prioritize patching or mitigating this vulnerability to prevent potential session cookie theft and client account takeover.

Technical summary

InvoiceNinja v5-stable renders an invoice or quote's 'terms' field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} without HTML sanitization. An authenticated user with invoice creation access can set the terms field to an HTML/JavaScript payload that executes in the client's browser when they view the invoice, enabling session cookie theft and client account takeover. This vulnerability is distinct from the previously published invoice line-item description field XSS (GHSA-98wm-cxpw-847p / CVE-2026-33628).

Defensive priority

Authenticated users with invoice creation access can exploit this vulnerability to execute HTML/JavaScript payloads in clients' browsers, enabling session cookie theft and client account takeover.

Recommended defensive actions

• Review and sanitize user-input terms field data
• Implement HTML sanitization for terms field rendering
• Restrict access to invoice creation to authorized users
• Monitor for suspicious activity on client accounts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability exists in InvoiceNinja v5-stable, where the 'terms' field in the client portal is rendered using Laravel Blade's raw output directive without HTML sanitization. Authenticated users with invoice creation access can set the terms field to an HTML/JavaScript payload that executes in the client's browser. This issue allows for session cookie theft and client account takeover. Evidence is limited to public sources and vendor statements. Defenders should verify system configurations, review user input sanitization, and monitor for suspicious activity.

Official resources