Authorization Flaw in InvoiceShelf Web and Mobile App by InvoiceShelf

CVE-2026-55381

What is CVE-2026-55381?

An authorization issue exists in the InvoiceShelf app that enables authenticated users with 'create-invoice' permissions to access and manipulate estimates from other companies. Prior to the release of version 2.4.0, an authenticated user could exploit this flaw by converting estimates into invoices, thus copying sensitive information such as line items, prices, taxes, and customer details from one company to another. This could lead to severe data leakage and financial discrepancies, as users could change or delete the original estimates belonging to victim companies.

References