CVE-2026-55383

8.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-285

Impact

Remote, unauthenticated attackers can access other companies' sensitive invoices, estimates, and payment records by supplying valid or expired email tokens across mismatched endpoints. They only need network access to the public customer routes and an existing email token.

Root cause

Customer document routes resolve numeric IDs without checking the associated document type (mailable_type) and JSON route handlers fail to enforce token expiration.

Affected systems

InvoiceShelf prior to version 2.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Fix & remediation

Upgrade InvoiceShelf to version 2.4.0 or later. If upgrading immediately is not possible, block or restrict access to the public routes /customer/invoices/*, /customer/estimates/*, and /customer/payments/* at your reverse proxy.

shell

$ git fetch --tags && git checkout v2.4.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55383