Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55383— InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

Quick assessment

Affected
InvoiceShelf InvoiceShelf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

InvoiceShelf 是一款开源的 Web 和移动应用，用于跟踪费用、付款，并创建专业的发票和估算单。在 2.4.0 版本之前，InvoiceShelf 面向公众客户的发票、估算单和付款路由在处理时，直接使用 EmailLog 表中令牌的数值型 mailable_id，而未对 mailable_type 进行验证；同时，JSON 接口处理器也未强制执行 EmailLog::isExpired 过期检查。因此，当数值型标识符发生碰撞时，为一种文档类型颁发的令牌可能会泄露另一家公司的文档内容；此外，已过期的令牌仍可

CVSS 8.2 · High EPSS 0.42% · P35

Affected Version Matrix 1

VendorProduct Version RangeStatus
InvoiceShelf InvoiceShelf < 2.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55383

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
InvoiceShelf InvoiceShelf < 2.4.0 -

II. Public POCs for CVE-2026-55383

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55383

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55383 (2)

Other References for CVE-2026-55383 (2)

Same Patch Batch · InvoiceShelf · 2026-10-14 · 7 CVEs total

CVE-2026-55382 7.6 HIGH InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NoteP
CVE-2026-55387 7.2 HIGH InvoiceShelf bulk deletion lacks company scoping
CVE-2026-55386 7.1 HIGH InvoiceShelf ORDER BY SQL injection through orderByField
CVE-2026-55381 7.1 HIGH InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user
CVE-2026-55385 6.8 MEDIUM InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
CVE-2026-55384 5.3 MEDIUM InvoiceShelf trusts client-supplied document totals

IV. Related Vulnerabilities

Same product: InvoiceShelf
Same vendor: InvoiceShelf
Same weakness: CWE-285

V. Comments for CVE-2026-55383

No comments yet

Leave a comment