Authorization Flaw in InvoiceShelf Allows Unauthorized Access to Notes

CVE-2026-55382

What is CVE-2026-55382?

InvoiceShelf, an open-source application for tracking expenses and managing invoices, experienced a significant authorization flaw prior to version 2.4.0. The impact arises from inadequate checks in the NotesController methods, which fail to ensure that staff users could only access their company's notes. As a result, an authenticated user with basic note management abilities could exploit the system to access, modify, or delete notes belonging to different companies. This vulnerability demonstrates a serious risk of unauthorized data exposure within the application. The issue is resolved in version 2.4.0, which enforces proper authorization checks to mitigate such risks.

References