Is CVE-2026-110765 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110765?

CVE-2026-110765 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-110765

Description

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.