{"id":"CVE-2026-110765","summary":"FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass","details":"FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.","modified":"2026-10-17T02:30:50.537170160Z","published":"2026-10-14T18:47:41.613Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110765.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110765.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110765"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/flexprice-through-2.1.38-quickbooks-webhook-signature-verification-bypass"},{"type":"PACKAGE","url":"https://github.com/flexprice/flexprice"},{"type":"ARTICLE","url":"https://github.com/flexprice/flexprice/blob/f27da32f84ee34bad4bf39a8d887af87fc3f30fc/internal/api/v1/webhook.go#L750"},{"type":"EVIDENCE","url":"https://hackmd.io/@hieuPenguinnn/flexprice-quickbooks-webhook-signature-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/flexprice/flexprice","events":[{"introduced":"0"},{"fixed":"f27da32f84ee34bad4bf39a8d887af87fc3f30fc"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.1.38"},{"fixed":"2.1.38"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v2.1.37","v2.1.36","v2.1.35","v2.1.34","v2.1.33","v2.1.32","v2.1.31","v2.1.30","v2.1.29","v2.1.28","v2.1.27","v2.1.26","v2.1.25","v2.1.24","2.1.24","v2.1.23","v2.1.22","v2.1.21","v2.0.24","v2.0.23","v2.0.22","v2.0.21","v2.1.20","v2.1.19","v2.1.18","2.1.17","2.1.16","2.1.12","v2.1.11","v2.1.9","v2.1.10","v2.1.8","v2.1.6","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.20","v2.0.19","v2.0.18","v2.0.17","v2.0.16","v2.0.15","v2.0.13","v2.0.14","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.4","v1.0.65","1.0.64","v1.0.63","1.0.61","v1.0.60","v1.1.59","v1.0.59","v1.0.47","v1.0.42","v1.0.38","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.28","v1.0.27","v1.0.25","v1.0.23","v1.0.22","v1.0.21","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.13","v1.0.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110765.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}