CVE-2026-55384: InvoiceShelf trusts client-supplied document totals
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, subtotal, tax, discountval, and dueamount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated InvoiceShelf user can exploit it by submitting manipulated total, subtotal, tax, discount, or due-amount values when creating invoices, estimates, or recurring invoices.
Which document workflows are affected?
The affected creation paths are invoices, estimates, and recurring invoices. In each case, stored financial totals can be made inconsistent with the submitted line-item prices and quantities.
What version fixes the issue?
The issue is fixed in InvoiceShelf version 2.4.0. Versions prior to 2.4.0 are affected.