CVE-2026-55384 Details
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.
A vulnerability exists in InvoiceShelf versions prior to 2.4.0, allowing authenticated users to manipulate financial totals when creating invoices, estimates, or recurring invoices. The application accepts client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying their accuracy against the submitted line items. This discrepancy can lead to financial records being corrupted, as the stored document totals may not align with the actual item prices and quantities. The issue arises because the invoice, estimate, and recurring-invoice creation paths do not perform server-side recalculations of these financial totals, leaving room for exploitation.
Users can upgrade to InvoiceShelf version 2.4.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the InvoiceShelf GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/665 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | < 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |