Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55387 (GCVE-0-2026-55387)

Vulnerability from nvd – Published: 2026-10-14 19:21 – Updated: 2026-10-15 15:56

Title

InvoiceShelf bulk deletion lacks company scoping

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:56 UTC

CWE

CWE-284 - Improper Access Control
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55387",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:56:46.482453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:56:54.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user\u0027s company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company\u0027s identifier and delete cross-company records. This vulnerability is fixed in 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:21:49.520Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wxrv-73x6-8r62",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf bulk deletion lacks company scoping"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55387",
    "datePublished": "2026-10-14T19:21:49.520Z",
    "dateReserved": "2026-06-16T18:57:40.183Z",
    "dateUpdated": "2026-10-15T15:56:54.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55386 (GCVE-0-2026-55386)

Vulnerability from nvd – Published: 2026-10-14 19:18 – Updated: 2026-10-14 19:44

Title

InvoiceShelf ORDER BY SQL injection through orderByField

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:44 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/663	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55386",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:44:04.537369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:44:29.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user\u0027s orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:18:57.322Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/663",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/663"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cp8p-jcqf-j39c",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf ORDER BY SQL injection through orderByField"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55386",
    "datePublished": "2026-10-14T19:18:57.322Z",
    "dateReserved": "2026-06-16T18:57:40.183Z",
    "dateUpdated": "2026-10-14T19:44:29.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55385 (GCVE-0-2026-55385)

Vulnerability from nvd – Published: 2026-10-14 19:25 – Updated: 2026-10-20 02:02

Title

InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 02:01 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/664	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55385",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T02:01:53.814292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T02:02:13.638Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf\u0027s PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:25:32.410Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/664",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/664"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mfxg-qphw-3f3g",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55385",
    "datePublished": "2026-10-14T19:25:32.410Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-20T02:02:13.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55384 (GCVE-0-2026-55384)

Vulnerability from nvd – Published: 2026-10-14 19:17 – Updated: 2026-10-15 15:05

Title

InvoiceShelf trusts client-supplied document totals

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:52 UTC

CWE

CWE-284 - Improper Access Control
CWE-472 - External Control of Assumed-Immutable Web Parameter

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/665	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:52:05.889221Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:05:50.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472: External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:17:25.099Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/665",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/665"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8c69-ch98-87r6",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf trusts client-supplied document totals"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55384",
    "datePublished": "2026-10-14T19:17:25.099Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T15:05:50.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55383 (GCVE-0-2026-55383)

Vulnerability from nvd – Published: 2026-10-14 19:23 – Updated: 2026-10-14 19:43

Title

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:43 UTC

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/662	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55383",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:43:24.649895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:43:41.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token\u0027s numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company\u0027s document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:23:33.527Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/662",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/662"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/5839d8385debf379644f55e773639e1c7e673163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/5839d8385debf379644f55e773639e1c7e673163"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-73q7-2953-8gvx",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55383",
    "datePublished": "2026-10-14T19:23:33.527Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-14T19:43:41.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55382 (GCVE-0-2026-55382)

Vulnerability from nvd – Published: 2026-10-14 19:27 – Updated: 2026-10-15 15:05

Title

InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:52 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:52:05.123998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:05:40.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note\u0027s company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company\u0027s sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:27:00.216Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-85wc-38p4-2wqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-85wc-38p4-2wqq"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-85wc-38p4-2wqq",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55382",
    "datePublished": "2026-10-14T19:27:00.216Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T15:05:40.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55381 (GCVE-0-2026-55381)

Vulnerability from nvd – Published: 2026-10-14 19:24 – Updated: 2026-10-15 14:17

Title

InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:16 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55381",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:16:05.029176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:17:15.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller\u0027s create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company\u0027s line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker\u0027s company. The victim company\u0027s configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:24:20.102Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j2vg-rxqr-5vc9",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies\u0027 estimates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55381",
    "datePublished": "2026-10-14T19:24:20.102Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T14:17:15.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55610 (GCVE-0-2026-55610)

Vulnerability from nvd – Published: 2026-09-23 14:38 – Updated: 2026-09-23 19:44

Title

InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:14 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:14:01.010220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:44:59.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf\u0027s multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company \u2014 it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:38:07.581Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr"
        }
      ],
      "source": {
        "advisory": "GHSA-vgx6-6cqr-m8qr",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55610",
    "datePublished": "2026-09-23T14:38:07.581Z",
    "dateReserved": "2026-06-16T23:31:22.445Z",
    "dateUpdated": "2026-09-23T19:44:59.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34367 (GCVE-0-2026-34367)

Vulnerability from nvd – Published: 2026-03-31 20:16 – Updated: 2026-04-03 16:25

Title

InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-03 16:25 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34367",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-03T16:25:03.150520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-03T16:25:18.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:16:11.149Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-q9wx-ggwq-mcgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-q9wx-ggwq-mcgh"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-q9wx-ggwq-mcgh",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34367",
    "datePublished": "2026-03-31T20:16:11.149Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-03T16:25:18.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34366 (GCVE-0-2026-34366)

Vulnerability from nvd – Published: 2026-03-31 20:05 – Updated: 2026-04-01 18:42

Title

InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 18:41 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34366",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T18:41:57.210814Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T18:42:09.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:05:57.318Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-38hf-fq8x-q49r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-38hf-fq8x-q49r"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-38hf-fq8x-q49r",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34366",
    "datePublished": "2026-03-31T20:05:57.318Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-01T18:42:09.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34365 (GCVE-0-2026-34365)

Vulnerability from nvd – Published: 2026-03-31 19:44 – Updated: 2026-04-01 13:42

Title

InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module. User-supplied HTML in the estimate Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF preview and customer view endpoints regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 13:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34365",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T13:42:04.599372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T13:42:08.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module. User-supplied HTML in the estimate Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF preview and customer view endpoints regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T19:44:06.712Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pc5v-8xwc-v9xq",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34365",
    "datePublished": "2026-03-31T19:44:06.712Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-01T13:42:08.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55382 (GCVE-0-2026-55382)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:27 – Updated: 2026-10-15 15:05

Title

InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:52 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:52:05.123998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:05:40.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note\u0027s company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company\u0027s sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:27:00.216Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-85wc-38p4-2wqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-85wc-38p4-2wqq"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-85wc-38p4-2wqq",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55382",
    "datePublished": "2026-10-14T19:27:00.216Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T15:05:40.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55385 (GCVE-0-2026-55385)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:25 – Updated: 2026-10-20 02:02

Title

InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 02:01 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/664	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55385",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T02:01:53.814292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T02:02:13.638Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf\u0027s PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:25:32.410Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/664",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/664"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mfxg-qphw-3f3g",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55385",
    "datePublished": "2026-10-14T19:25:32.410Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-20T02:02:13.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55381 (GCVE-0-2026-55381)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:24 – Updated: 2026-10-15 14:17

Title

InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:16 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55381",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:16:05.029176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:17:15.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller\u0027s create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company\u0027s line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker\u0027s company. The victim company\u0027s configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:24:20.102Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j2vg-rxqr-5vc9",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies\u0027 estimates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55381",
    "datePublished": "2026-10-14T19:24:20.102Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T14:17:15.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55383 (GCVE-0-2026-55383)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:23 – Updated: 2026-10-14 19:43

Title

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:43 UTC

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/662	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55383",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:43:24.649895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:43:41.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token\u0027s numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company\u0027s document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:23:33.527Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/662",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/662"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/5839d8385debf379644f55e773639e1c7e673163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/5839d8385debf379644f55e773639e1c7e673163"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-73q7-2953-8gvx",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55383",
    "datePublished": "2026-10-14T19:23:33.527Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-14T19:43:41.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55387 (GCVE-0-2026-55387)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:21 – Updated: 2026-10-15 15:56

Title

InvoiceShelf bulk deletion lacks company scoping

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:56 UTC

CWE

CWE-284 - Improper Access Control
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/661	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55387",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:56:46.482453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:56:54.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user\u0027s company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company\u0027s identifier and delete cross-company records. This vulnerability is fixed in 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:21:49.520Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wxrv-73x6-8r62",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf bulk deletion lacks company scoping"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55387",
    "datePublished": "2026-10-14T19:21:49.520Z",
    "dateReserved": "2026-06-16T18:57:40.183Z",
    "dateUpdated": "2026-10-15T15:56:54.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55386 (GCVE-0-2026-55386)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:18 – Updated: 2026-10-14 19:44

Title

InvoiceShelf ORDER BY SQL injection through orderByField

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:44 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/663	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55386",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:44:04.537369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:44:29.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user\u0027s orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:18:57.322Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/663",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/663"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cp8p-jcqf-j39c",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf ORDER BY SQL injection through orderByField"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55386",
    "datePublished": "2026-10-14T19:18:57.322Z",
    "dateReserved": "2026-06-16T18:57:40.183Z",
    "dateUpdated": "2026-10-14T19:44:29.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55384 (GCVE-0-2026-55384)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:17 – Updated: 2026-10-15 15:05

Title

InvoiceShelf trusts client-supplied document totals

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:52 UTC

CWE

CWE-284 - Improper Access Control
CWE-472 - External Control of Assumed-Immutable Web Parameter

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/665	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/comm…	x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:52:05.889221Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:05:50.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472: External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:17:25.099Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/665",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/665"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8c69-ch98-87r6",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf trusts client-supplied document totals"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55384",
    "datePublished": "2026-10-14T19:17:25.099Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-10-15T15:05:50.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55610 (GCVE-0-2026-55610)

Vulnerability from cvelistv5 – Published: 2026-09-23 14:38 – Updated: 2026-09-23 19:44

Title

InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:14 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:14:01.010220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:44:59.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf\u0027s multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company \u2014 it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:38:07.581Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr"
        }
      ],
      "source": {
        "advisory": "GHSA-vgx6-6cqr-m8qr",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55610",
    "datePublished": "2026-09-23T14:38:07.581Z",
    "dateReserved": "2026-06-16T23:31:22.445Z",
    "dateUpdated": "2026-09-23T19:44:59.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34367 (GCVE-0-2026-34367)

Vulnerability from cvelistv5 – Published: 2026-03-31 20:16 – Updated: 2026-04-03 16:25

Title

InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-03 16:25 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34367",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-03T16:25:03.150520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-03T16:25:18.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:16:11.149Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-q9wx-ggwq-mcgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-q9wx-ggwq-mcgh"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-q9wx-ggwq-mcgh",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34367",
    "datePublished": "2026-03-31T20:16:11.149Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-03T16:25:18.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34366 (GCVE-0-2026-34366)

Vulnerability from cvelistv5 – Published: 2026-03-31 20:05 – Updated: 2026-04-01 18:42

Title

InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 18:41 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34366",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T18:41:57.210814Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T18:42:09.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:05:57.318Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-38hf-fq8x-q49r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-38hf-fq8x-q49r"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-38hf-fq8x-q49r",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34366",
    "datePublished": "2026-03-31T20:05:57.318Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-01T18:42:09.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34365 (GCVE-0-2026-34365)

Vulnerability from cvelistv5 – Published: 2026-03-31 19:44 – Updated: 2026-04-01 13:42

Title

InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module. User-supplied HTML in the estimate Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF preview and customer view endpoints regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 13:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/InvoiceShelf/InvoiceShelf/secu…	x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InvoiceShelf	InvoiceShelf	Affected: < 2.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34365",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T13:42:04.599372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T13:42:08.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvoiceShelf",
          "vendor": "InvoiceShelf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module. User-supplied HTML in the estimate Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF preview and customer view endpoints regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T19:44:06.712Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-pc5v-8xwc-v9xq"
        },
        {
          "name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pc5v-8xwc-v9xq",
        "discovery": "UNKNOWN"
      },
      "title": "InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34365",
    "datePublished": "2026-03-31T19:44:06.712Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-04-01T13:42:08.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

22 vulnerabilities by InvoiceShelf

CVE-2026-55387 (GCVE-0-2026-55387)

CVE-2026-55386 (GCVE-0-2026-55386)

CVE-2026-55385 (GCVE-0-2026-55385)

CVE-2026-55384 (GCVE-0-2026-55384)

CVE-2026-55383 (GCVE-0-2026-55383)

CVE-2026-55382 (GCVE-0-2026-55382)

CVE-2026-55381 (GCVE-0-2026-55381)

CVE-2026-55610 (GCVE-0-2026-55610)

CVE-2026-34367 (GCVE-0-2026-34367)

CVE-2026-34366 (GCVE-0-2026-34366)

CVE-2026-34365 (GCVE-0-2026-34365)

CVE-2026-55382 (GCVE-0-2026-55382)

CVE-2026-55385 (GCVE-0-2026-55385)

CVE-2026-55381 (GCVE-0-2026-55381)

CVE-2026-55383 (GCVE-0-2026-55383)

CVE-2026-55387 (GCVE-0-2026-55387)

CVE-2026-55386 (GCVE-0-2026-55386)

CVE-2026-55384 (GCVE-0-2026-55384)

CVE-2026-55610 (GCVE-0-2026-55610)

CVE-2026-34367 (GCVE-0-2026-34367)

CVE-2026-34366 (GCVE-0-2026-34366)

CVE-2026-34365 (GCVE-0-2026-34365)