CVE-2026-55382

Deferred Deferred - Pending Action

Unauthorized Note Access in InvoiceShelf Prior to 2.4.0

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55382

EUVD

EUVD-2026-101613

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-55382 is an authorization bypass vulnerability in InvoiceShelf versions before 2.4.0. It allows authenticated staff users with basic note permissions to access, modify, or delete notes belonging to other companies by manipulating note IDs. The issue occurs because the NotesController does not enforce company-level restrictions when resolving notes, and the NotePolicy lacks tenant checks.

Detection Guidance

Check InvoiceShelf version with: grep -r "InvoiceShelf" /path/to/installation | grep version. If version is below 2.4.0, the system is vulnerable. Review NotePolicy implementation for missing company_id checks in show(), update(), and destroy() methods.

Impact Analysis

An attacker with ordinary note permissions could read, modify, or delete another company's reusable invoice, estimate, or payment note templates. This could lead to data leaks, unauthorized changes to financial documents, or disruption of services. The impact is limited to note templates and does not affect invoices, customers, or payments directly.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive financial or customer data stored in note templates. It undermines access control requirements and could lead to compliance breaches, fines, or reputational damage.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later immediately. Review and update NotePolicy to enforce company_id checks in all note-related actions. Restrict staff user permissions to least privilege required.

Hi! I’m here to help you understand CVE-2026-55382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70