Vulnerability in InvoiceShelf Affects Invoice Creation and Payment Processing

CVE-2026-55384

What is CVE-2026-55384?

InvoiceShelf, an open-source web and mobile application designed for expense tracking and professional invoice generation, suffers from a vulnerability that allows authenticated users to manipulate financial totals. Prior to version 2.4.0, the application's invoice, estimate, and recurring invoice creation functionalities did not validate user-supplied monetary values for total, sub_total, tax, discount_val, and due_amount against the actual line items provided. This oversight can lead to discrepancies in stored document totals compared to item prices and quantities. This issue has been addressed in version 2.4.0, which is essential for ensuring the integrity of financial data within the application.

References