CVE-2026-55610
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
InvoiceShelf prior to version 2.4.1 in multi-company installations allows an Owner of one company to read and overwrite any user account in any other company. The vulnerability stems from missing verification that the target user belongs to the requester's company, enabling account takeover.
Risk Assessment
The risk includes cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment), which could lead to serious security breaches.
Recommendation
Update InvoiceShelf to version 2.4.1 or later immediately, as it fixes the issue.
Other vulnerabilities in InvoiceShelf
See all- CVE-2026-34367High
InvoiceShelf prior to version 2.2.0 has an SSRF vulnerability in the PDF generation module. User-supplied HTML in the Notes field is passed unsanitized to the Dompdf library, which fetches remote resources, exploitable via PDF preview and email delivery endpoints.
- CVE-2026-34366High
InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF receipt generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.
- CVE-2026-34365High
InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF estimate generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.
Original NVD description (English source)
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS