CVE-2026-55381

7.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-639

Impact

Authenticated users with invoice-creation rights can steal another company's estimates, exposing customer details, line items, and pricing, and potentially alter or delete the victim's original estimate. Attackers only need network access to the API and standard user credentials with invoice creation permissions.

Root cause

The estimate conversion endpoint checks invoice creation permissions but fails to verify that the route-bound estimate belongs to the requesting user's company.

Affected systems

InvoiceShelf prior to version 2.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fix & remediation

Upgrade InvoiceShelf to version 2.4.0 or later. No interim workaround is documented.

shell

$ git fetch --tags && git checkout v2.4.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55381