CVE-2026-55384

Deferred Deferred - Pending Action

Stored Financial Manipulation in InvoiceShelf

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55384

EUVD

EUVD-2026-101586

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

Executive Summary

This vulnerability in InvoiceShelf allows authenticated users to manipulate financial totals when creating or updating invoices, estimates, or recurring invoices. The system accepts fields like total, sub_total, tax, discount_val, and due_amount directly from requests without verifying they match the submitted line items. This enables attackers to submit incorrect totals that do not reflect actual line item values, corrupting financial records.

Detection Guidance

To detect this vulnerability, inspect network traffic for invoice or estimate creation requests in InvoiceShelf versions prior to 2.4.0. Look for mismatches between submitted line item totals and client-provided financial fields like total, sub_total, tax, discount_val, or due_amount. Check server logs for requests where these values do not align with line item calculations.

Impact Analysis

This vulnerability can lead to financial discrepancies where stored document totals do not match actual line item prices and quantities. It may cause incorrect calculations for payments, taxes, or discounts, potentially resulting in financial losses or disputes. Users could exploit this to manipulate due amounts or paid amounts during invoice updates.

Compliance Impact

This vulnerability could lead to financial record tampering, which may violate compliance requirements for accurate financial reporting in standards like GDPR (data integrity principles) and HIPAA (accounting of disclosures and financial integrity). Manipulated totals in invoices or estimates could result in incorrect financial data being stored or transmitted, potentially breaching regulatory obligations for data accuracy and auditability.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later immediately. If upgrading is not possible, implement server-side validation to recompute financial totals from line items before storing them. Ensure no client-provided totals override server-calculated values.

Hi! I’m here to help you understand CVE-2026-55384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70