Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55382— InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

Quick assessment

Affected
InvoiceShelf InvoiceShelf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

InvoiceShelf 是一款开源的 Web 和移动应用，用于跟踪费用、付款，并生成专业的发票和报价单。在版本 2.4.0 之前，InvoiceShelf 的 、 和 方法仅授权通用的“查看笔记”或“管理笔记”权限，且未将路由绑定的笔记对象传递给 或 方法。因此，这两种策略方法均未对目标笔记所属的 进行校验。 由于 模型未设置全局的公司范围（company scope），具备普通笔记权限的已认证员工用户可通过枚举其他公司的连续笔记标识符，读取、修改或删除其他公司的可复用发票、报价单和付款笔记模板。该问题已在版本

CVSS 7.6 · High EPSS 0.38% · P31

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
InvoiceShelf InvoiceShelf < 2.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55382

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
Source: CVE Program / CVE List V5
Vulnerability Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
InvoiceShelf InvoiceShelf < 2.4.0 -

II. Public POCs for CVE-2026-55382

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55382

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55382 (2)

Other References for CVE-2026-55382 (2)

Same Patch Batch · InvoiceShelf · 2026-10-14 · 7 CVEs total

CVE-2026-55383 8.2 HIGH InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
CVE-2026-55387 7.2 HIGH InvoiceShelf bulk deletion lacks company scoping
CVE-2026-55386 7.1 HIGH InvoiceShelf ORDER BY SQL injection through orderByField
CVE-2026-55381 7.1 HIGH InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user
CVE-2026-55385 6.8 MEDIUM InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
CVE-2026-55384 5.3 MEDIUM InvoiceShelf trusts client-supplied document totals

IV. Related Vulnerabilities

Same product: InvoiceShelf
Same vendor: InvoiceShelf
Same weakness: CWE-639

V. Comments for CVE-2026-55382

No comments yet

Leave a comment