CVE-2026-55384

UNKNOWN 0.0

InvoiceShelf trusts client-supplied document totals

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.

CWE	CWE-284 CWE-472
Vendor	invoiceshelf
Product	invoiceshelf
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for invoiceshelf invoiceshelf

Be the first to know when new unknown vulnerabilities affecting invoiceshelf invoiceshelf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

InvoiceShelf / InvoiceShelf

< 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6 github.com: https://github.com/InvoiceShelf/InvoiceShelf/pull/665 github.com: https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b github.com: https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0