Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N N N H N 8.2 .0022 12.3 —
AFFECTED Product Versions Fixed flexprice unspecified —
TIMELINE Oct 14 EXPLOIT PUBLISHED — CVE-2026-110765 (flexprice). Public exploit reference added. Oct 14 Reserved by VulnCheck Oct 14 Published (CNA: VulnCheck)
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
| Date | Event | Detail |
|---|---|---|
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-110765 (flexprice). Public exploit reference added. |
| October 14, 2026 | Reserved | Reserved by VulnCheck |
| October 14, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| flexprice | flexprice | — | — | — |
Authoritative record: CVE-2026-110765 at cve.org
Vendors: flexprice
Weaknesses: CWE-347
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-110765 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
