CVE-2026-55382
7.6HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-639
Impact
Authenticated staff users can view, edit, or delete another company's invoice, estimate, and payment note templates. An attacker only needs network access and a valid low-privilege staff account with basic note permissions.
Root cause
NotesController actions authorize generic note permissions without passing the target note to NotePolicy or scoping the model by company_id, allowing cross-tenant object access via sequential IDs.
Affected systems
InvoiceShelf prior to version 2.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Fix & remediation
Upgrade InvoiceShelf to version 2.4.0. If you cannot upgrade immediately, revoke note-related permissions from non-admin staff users across all tenants.
$ git fetch --tags && git checkout v2.4.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.