Authorization Flaw in InvoiceShelf Open-Source Application

CVE-2026-55387

What is CVE-2026-55387?

The InvoiceShelf application, a tool for tracking expenses and creating invoices, has a vulnerability in versions 2.3.3 and earlier. It permits authenticated users to perform bulk delete operations without proper checks on record ownership. Specifically, requests such as DeleteCustomersRequest and DeleteInvoicesRequest validate the existence of identifiers but fail to restrict operations to the authenticated user's company. This weakness allows users to delete records belonging to other companies, posing significant risks to data integrity and security. This issue has been resolved in version 2.4.0.

References