CVE-2026-55381

Deferred Deferred - Pending Action

Authorization Bypass in InvoiceShelf Converting Estimates

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55381

EUVD

EUVD-2026-101611

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-55381 is an Insecure Direct Object Reference (IDOR) vulnerability in InvoiceShelf's estimate-to-invoice conversion feature. It allows authenticated users with create-invoice ability to access and tamper with estimates belonging to other companies on the same multi-tenant instance. The endpoint POST /api/v1/estimates/{estimate}/convert-to-invoice fails to enforce company boundaries, enabling attackers to read financial data like line items and prices from other companies' estimates.

Detection Guidance

To detect this vulnerability, monitor API logs for unauthorized POST requests to /api/v1/estimates/{estimate}/convert-to-invoice. Check for requests where the estimate ID belongs to a different company than the authenticated user. Use tools like curl to test endpoints: curl -X POST -H 'Authorization: Bearer <token>' -H 'Company-ID: <attacker_company>' http://<target>/api/v1/estimates/<victim_estimate_id>/convert-to-invoice. If the request succeeds, the system is vulnerable.

Impact Analysis

An attacker could exploit this to steal sensitive financial data such as line items, pricing, taxes, notes, currency, and customer details from other companies. They may also trigger the victim company's configured conversion action, potentially deleting or modifying the original estimate if non-default settings are used.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive financial and customer data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in data breaches, non-compliance penalties, and reputational damage.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later immediately. If upgrading is not possible, apply the patch from commit e432e4e62f5aa52238e3ff3fc37a0c78588eec47. Ensure all API endpoints enforce company scope checks and validate user permissions before processing requests.

Hi! I’m here to help you understand CVE-2026-55381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70