CVE-2026-122158: InvoiceShelf MemberService.php create access control
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.4Patch c798b513c3ab6e672a1678774720fbb282f4d0c6 - Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 3.0.0-alpha.4
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that the attacker needs high privileges. Exploitation is remote and does not require user interaction.
Which deployments are affected and which releases fix the issue?
InvoiceShelf versions through 2.4.3 and through 3.0.0-alpha.3 are affected. Upgrade to 2.4.4 or 3.0.0-alpha.4, respectively; the referenced patch is c798b513c3ab6e672a1678774720fbb282f4d0c6.
What should teams prioritize if they cannot upgrade immediately?
Prioritize systems where highly privileged users can create members and supply company IDs or roles, because the vulnerable MemberService::create path accepts manipulation of companies[].id and companies[].role. Public exploit code is available, so exposure should be treated as actionable.