CVE-2026-55387

UNKNOWN 0.0

InvoiceShelf bulk deletion lacks company scoping

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

CWE	CWE-284 CWE-639
Vendor	invoiceshelf
Product	invoiceshelf
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for invoiceshelf invoiceshelf

Be the first to know when new unknown vulnerabilities affecting invoiceshelf invoiceshelf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

InvoiceShelf / InvoiceShelf

< 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62 github.com: https://github.com/InvoiceShelf/InvoiceShelf/pull/661 github.com: https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47 github.com: https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0