CVE-2026-55387

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity, availability
Weakness: CWE-284, CWE-639

Impact

Authenticated users can delete other companies' invoices, customers, expenses, and records across tenants. The attacker only needs a low-privileged account on the target instance.

Root cause

Bulk-delete request validators confirm record IDs exist but fail to enforce ownership against the authenticated user's company_id.

Affected systems

InvoiceShelf 2.3.3 and earlier

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade InvoiceShelf to version 2.4.0. No interim workarounds are documented.

shell

$ git fetch --tags && git checkout v2.4.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55387