CVE-2026-55383: InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{emaillog:token}, GET /customer/estimates/{emaillog:token}, and GET /customer/payments/{emaillog:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
InvoiceShelf versions prior to 2.4.0 are affected. The vulnerable functionality is in public customer routes for invoices, estimates, and payments.
What does an attacker need to exploit this issue?
An attacker needs an EmailLog token issued for a document type whose numeric mailable_id collides with a document belonging to another company. No authentication or user interaction is required for the affected public routes.
Can expired tokens still be used?
Yes. The JSON handlers for the public invoice, estimate, and payment routes do not enforce EmailLog::isExpired, so expired tokens can remain usable.
What can happen besides document disclosure?
Mismatched invoice or estimate view handlers can mark the document as viewed and send a notification. This can create inaccurate viewing status and notifications in addition to cross-company disclosure.
What should be done if patching is not immediately possible?
The provided data identifies version 2.4.0 as the fix but does not specify an interim mitigation. Prioritize restricting or disabling exposure to the affected public customer invoice, estimate, and payment routes until the instance can be upgraded.