CVE-2026-55382: InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's companyid. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated staff user with ordinary note-viewing or note-management abilities can exploit it. The attacker does not need elevated administrative permissions, but must be able to identify another company's sequential note identifier.
What data and actions are exposed?
An attacker can access another company's reusable note templates for invoices, estimates, and payments. Depending on the endpoint used, they can read, modify, or delete those notes.
Are installations affected by default?
Affected versions prior to 2.4.0 are vulnerable because the relevant authorization checks do not evaluate the target note's company_id, and the Note model has no global company scope. Exposure requires multiple companies and a staff account with ordinary note abilities.
What should be done if an immediate upgrade is not possible?
Limit note-view and note-management abilities to only trusted staff, especially in multi-company deployments. Monitor for unexpected access, modification, or deletion of reusable invoice, estimate, and payment note templates until upgrading to 2.4.0.
How can teams determine whether they are affected?
Installations running a version earlier than 2.4.0 are affected. In a non-production test, a staff user from one company may be able to use another company's note identifier against note show, update, or delete operations.