CVE-2026-55387
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create…
- Risk score
- 48/100
- CVSS
- 7.2 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
- https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47
- https://github.com/InvoiceShelf/InvoiceShelf/pull/661
- https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62
Original description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.