CVE-2026-55381 (GCVE-0-2026-55381)
Vulnerability from cvelistv5
Published
2026-10-14 19:24
Modified
2026-10-15 14:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| InvoiceShelf | InvoiceShelf |
Version: < 2.4.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:16:05.029176Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:17:15.000Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvoiceShelf",
"vendor": "InvoiceShelf",
"versions": [
{
"status": "affected",
"version": "\u003c 2.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller\u0027s create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company\u0027s line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker\u0027s company. The victim company\u0027s configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T19:24:20.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9"
},
{
"name": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InvoiceShelf/InvoiceShelf/pull/661"
},
{
"name": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47"
},
{
"name": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0"
}
],
"source": {
"advisory": "GHSA-j2vg-rxqr-5vc9",
"discovery": "UNKNOWN"
},
"title": "InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies\u0027 estimates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55381",
"datePublished": "2026-10-14T19:24:20.102Z",
"dateReserved": "2026-06-16T18:57:40.182Z",
"dateUpdated": "2026-10-15T14:17:15.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55381\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T14:16:05.029176Z\"}}}], \"references\": [{\"url\": \"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T14:17:00.518Z\"}}], \"cna\": {\"title\": \"InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies\u0027 estimates\", \"source\": {\"advisory\": \"GHSA-j2vg-rxqr-5vc9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"InvoiceShelf\", \"product\": \"InvoiceShelf\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.4.0\"}]}], \"references\": [{\"url\": \"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9\", \"name\": \"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/InvoiceShelf/InvoiceShelf/pull/661\", \"name\": \"https://github.com/InvoiceShelf/InvoiceShelf/pull/661\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47\", \"name\": \"https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0\", \"name\": \"https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"InvoiceShelf is an open-source web \u0026 mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller\u0027s create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company\u0027s line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker\u0027s company. The victim company\u0027s configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-14T19:24:20.102Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-55381\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T14:17:15.000Z\", \"dateReserved\": \"2026-06-16T18:57:40.182Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-14T19:24:20.102Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…