CVE-2026-122158 Details
Description
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.
A cross-tenant privilege escalation vulnerability has been identified in InvoiceShelf versions through 2.4.3 and 3.0.0-alpha.3. The issue arises in the MemberService::create function, where improper access controls allow a company owner to assign an account to any company with an arbitrary role. This vulnerability can be exploited remotely by manipulating the companies[].id and companies[].role parameters. The flaw has been publicly disclosed and is being actively exploited.
Upgrade to InvoiceShelf version 2.4.4 or 3.0.0-alpha.4, both of which address this vulnerability by ensuring that company IDs in membership requests are validated against the caller's actual company ownership.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/capivara-research/GHSA-c9cx-7r7m-264v | [email protected] | ExploitRemedy |
| https://github.com/InvoiceShelf/InvoiceShelf/ | [email protected] | Vendor |
| https://github.com/InvoiceShelf/InvoiceShelf/commit/c798b513c3ab6e672a1678774720fbb282f4d0c6 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/822 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/3.0.0-alpha.4 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-c9cx-7r7m-264v | [email protected] | AdvisoryRemedyVendor |
| https://vuldb.com/cve/CVE-2026-122158 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1028117 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431158 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431158/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | <= 2.4.3 (semver) >= 3.0.0-alpha.1, <= 3.0.0-alpha.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |