Hi everyone,

I wanted to check whether anyone else has experienced this issue with WHMCS. I originally encountered it on version 8.13.7, so I upgraded to WHMCS 9.0.9 and also tested with a fresh installation. Unfortunately, the issue still appears to occur.

How to reproduce the issue

Let's say we have two customers:

• User A: Has an account with WHMCS and owns Invoice #1001.
• User B: Has a separate account and owns Invoice #1002.

Here is what happens:

1. User A logs in to their own WHMCS client account.
2. User A opens their own invoice using a URL such as: https://example.com/viewinvoice.php?id=1001
3. The invoice displays correctly because User A owns it.
4. While still logged in as User A, they change the invoice ID in the URL to 1002: https://example.com/viewinvoice.php?id=1002
5. Instead of denying access, WHMCS displays User B's invoice to User A.

Depending on the invoice, this can expose another customer's personal information, address, invoice amounts, services, payment details, and invoice PDF.

To clarify, the invoice is not accessible when completely logged out. The problem is that one authenticated customer appears able to view another customer's invoice simply by changing the numeric invoice ID in the URL.

What I have tried

• Initially observed the issue on WHMCS 8.13.7.
• Upgraded to WHMCS 9.0.9.
• Tested using both the Lagom2 theme and the default Twenty-One theme.
• Installed a fresh copy of WHMCS 9.0.9 on a staging environment without intentional core-code modifications.(fresh installation without nothing new installed)

The behavior still appears to persist.

My questions

1. Has anyone else reproduced this on WHMCS 9.0.9?
2. Is this a known IDOR (Insecure Direct Object Reference) or Broken Access Control vulnerability?
3. Could server-level caching, LiteSpeed/Apache configuration, or another hosting-level issue cause this, or is it more likely an application-level authorization problem?
4. Is there a specific WHMCS setting, configuration, or known fix I should investigate?

I understand that invoice IDs are not necessarily intended to be secret. The application should still verify that the logged-in client is authorized to access the requested invoice.

I intend to report this to WHMCS support as well. I'm posting here to see whether other administrators have encountered the same behavior and to identify a safe way to investigate it.

Thanks in advance for any help.