CVE-2026-97078: Boldgrid Client Invoicing By Sprout Invoices

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

Affected products

• Boldgrid Client Invoicing By Sprout Invoices: up to and including 20.8.17

Published 2026-09-30. Last modified 2026-09-30.