7Megaumka7

The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the `gateway id` variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the `invoice accessible from hash` system setting and the requirement that the gateway must be pre-installed by an administrator.

When a `ClientPasswordReset` record already exists for a client from a previous unexpired request, subsequent calls to the `reset password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is based on the `created at` timestamp of the first request rather than the most recent email. This allows an attacker who obtained the original reset link to use it even after the victim requests a new reset, as the original token is not invalidated or rotated.

The Guest `serviceapikey/get info` API endpoint is accessible without authentication. An attacker with a valid API key can retrieve all custom configuration parameters, specifically the `custom *` fields, stored in the database record associated with that key. These fields are managed by administrators and may contain sensitive business information, including pricing tiers, feature flags, rate limits, expiry overrides, or access scope data.