CVE-2026-55387

Deferred Deferred - Pending Action

Unauthorized Bulk Record Deletion in InvoiceShelf

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55387

EUVD

EUVD-2026-101609

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

InvoiceShelf versions 2.3.3 and earlier have a vulnerability where bulk-delete request validators do not consistently check that record identifiers belong to the authenticated user's company. This allows cross-company record deletion without proper access control.

Detection Guidance

Review InvoiceShelf logs for bulk-delete API requests that do not match the authenticated user's company_id. Check for requests targeting records outside the user's tenant scope. Compare request payloads against database records to identify unauthorized deletions.

Impact Analysis

An authenticated user could delete invoices, payments, customers, estimates, expenses, items, or users belonging to another company by submitting a crafted API request. This could lead to data loss and unauthorized access to sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized deletion of sensitive data, potentially breaching data integrity and access control policies mandated by GDPR, HIPAA, and other regulations.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later to apply the patch. If upgrading is not immediately possible, restrict API access to trusted networks and monitor bulk-delete endpoints for suspicious activity.

Hi! I’m here to help you understand CVE-2026-55387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70