Information Disclosure in InvoiceShelf by InvoiceShelf
CVE-2026-55383
What is CVE-2026-55383?
InvoiceShelf, an open-source web and mobile application for managing expenses and creating invoices, has a vulnerability that allows information disclosure due to inadequate handling of EmailLog tokens. In versions before 2.4.0, public routes for invoices, estimates, and payments fail to validate the mailable_type associated with a numeric identifier. This oversight may permit a valid token for one document type to inadvertently expose another company's document when numeric IDs clash. Additionally, expired tokens can be exploited through specific JSON routes, exposing them to unauthorized access. The issue has been addressed in version 2.4.0, highlighting the importance of implementing proper token management practices.
Affected Version(s)
InvoiceShelf < 2.4.0