CVE-2026-55383 Details
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.
A vulnerability in InvoiceShelf prior to version 2.4.0 allows for cross-company data disclosure through public customer document endpoints. The issue arises because these endpoints resolve an 'EmailLog' token by its numeric 'mailable_id' without verifying the 'mailable_type'. As a result, a token issued for one document type can access another type's data if the numeric IDs collide. Additionally, the JSON response endpoints do not check if the 'EmailLog' token has expired, allowing expired tokens to be reused indefinitely. This vulnerability could be exploited to access sensitive information from other companies' invoices, estimates, or payments.
Users are advised to update to InvoiceShelf version 2.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/commit/5839d8385debf379644f55e773639e1c7e673163 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/662 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-73q7-2953-8gvx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | < 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | New CVE Received | [email protected] |
| Oct 14, 2026 | CVE Modified | CISA-ADP |