CVE-2026-55387: InvoiceShelf bulk deletion lacks company scoping
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's companyid. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated InvoiceShelf user can exploit it by submitting identifiers for records belonging to another company. The issue is a cross-company authorization failure rather than unauthenticated access.
Which records may be deleted across company boundaries?
The affected bulk-delete validators cover customers, estimates, expenses, invoices, items, payments, and users. A vulnerable request may accept a record identifier without consistently confirming that it belongs to the authenticated user's company.
Which versions are affected and what is the fix?
InvoiceShelf version 2.3.3 and earlier are affected. Upgrade to version 2.4.0, which fixes the issue.