CVE-2026-122158— InvoiceShelf MemberService.php create access control

Quick assessment

Affected

n/a InvoiceShelf

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 InvoiceShelf 2.4.3 及 3.0.0-alpha.3 版本中发现了安全漏洞。该问题影响文件中的函数。攻击者可通过篡改或参数，绕过访问控制机制。该漏洞可被远程利用，且相关利用代码已公开，可能被用于实施攻击。升级至 2.4.4 或 3.0.0-alpha.4 版本可修复此问题，对应的补丁提交哈希为。建议尽快升级受影响的组件。

CVSS 4.7 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

InvoiceShelf MemberService.php create access control

Source: CVE Program / CVE List V5

Vulnerability Description

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

访问控制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	InvoiceShelf	2.4.0	`cpe:2.3:a:invoiceshelf:invoiceshelf::::::::`

II. Public POCs for CVE-2026-122158

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-122158

请登录查看更多情报信息。

Other References for CVE-2026-122158 (10)

https://github.com/InvoiceShelf/InvoiceShelf/ product
https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-c9cx-7r7m-264v related
https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/3.0.0-alpha.4 patch
https://github.com/InvoiceShelf/InvoiceShelf/commit/c798b513c3ab6e672a1678774720fbb282f4d0c6 patch
https://github.com/capivara-research/GHSA-c9cx-7r7m-264v exploit
https://github.com/InvoiceShelf/InvoiceShelf/pull/822 issue-tracking patch
https://vuldb.com/cve/CVE-2026-122158 third-party-advisory
https://vuldb.com/vuln/431158/cti signature permissions-required
https://vuldb.com/vuln/431158 vdb-entry technical-description
https://vuldb.com/submit/1028117 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-122158

Same Patch Batch · n/a · 2026-11-05 · 4 CVEs total

CVE-2026-122236	6.3 MEDIUM	OpenHands Landing missing authentication
CVE-2026-122151	4.3 MEDIUM	Presenton User Configuration user-config JSON.parse cross-site request forgery
CVE-2026-122052	4.3 MEDIUM	laspy LAS File lasreader.py memory allocation

IV. Related Vulnerabilities

Same product: InvoiceShelf

Same vendor: n/a

Same weakness: CWE-284