CVE-2026-55383

Deferred Deferred - Pending Action

Authentication Bypass via EmailLog Token in InvoiceShelf

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55383

EUVD

EUVD-2026-101610

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-55383 is a token type confusion vulnerability in InvoiceShelf versions before 2.4.0. It allows an attacker to access documents from other companies by exploiting numeric ID collisions in EmailLog tokens. The system fails to verify the mailable_type when resolving tokens, enabling unauthorized cross-company data disclosure. Additionally, expired tokens remain usable on JSON endpoints due to missing expiry checks.

Detection Guidance

Check InvoiceShelf version with: grep -r "InvoiceShelf" /path/to/installation | grep version. If version is below 2.4.0, the system is vulnerable. Review logs for unauthorized access to /customer/invoices/, /customer/estimates/, or /customer/payments/ endpoints with expired or mismatched tokens.

Impact Analysis

This vulnerability could allow unauthorized users to view sensitive invoice, estimate, or payment data belonging to other companies. Attackers could exploit expired tokens to access confidential documents without time restrictions. It may also enable state mutations by marking documents as viewed and sending notifications for mismatched document types.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by enabling unauthorized access to sensitive personal and financial data across companies. It compromises confidentiality requirements and could lead to regulatory penalties due to improper data handling and disclosure.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later immediately. If upgrading is not possible, restrict access to the affected endpoints (/customer/invoices/, /customer/estimates/, /customer/payments/) until patched. Review and invalidate all existing EmailLog tokens to prevent replay attacks.

Hi! I’m here to help you understand CVE-2026-55383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70