CVE-2026-55381 Details
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.
A vulnerability exists in InvoiceShelf versions prior to 2.4.0, specifically within the estimate-to-invoice conversion feature. The issue arises in the ConvertEstimateController, where the POST /api/v1/estimates/{estimate}/convert-to-invoice endpoint fails to properly authorize access to the specified estimate. Instead, it only verifies the user's ability to create invoices within their own company. This oversight allows authenticated users with invoice creation rights to access and copy line items, prices, totals, taxes, notes, currency, and customer data from estimates belonging to other companies into invoices for their own company. Additionally, the conversion process can trigger actions that modify or delete the original estimate, further exploiting the vulnerability.
Users are advised to update to InvoiceShelf version 2.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/661 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | < 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |