CVE-2026-122158
Deferred Deferred - Pending Action

Improper Access Control in InvoiceShelf Application

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122158
EUVD
EUVD-2026-117210

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
n/a InvoiceShelf 2.4.0
n/a InvoiceShelf 2.4.1
n/a InvoiceShelf 2.4.2
n/a InvoiceShelf 2.4.3
n/a InvoiceShelf 3.0.0-alpha.0
n/a InvoiceShelf 3.0.0-alpha.1
n/a InvoiceShelf 3.0.0-alpha.2
n/a InvoiceShelf 3.0.0-alpha.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-tenant privilege escalation flaw in InvoiceShelf, a multi-tenant invoicing application. It allows an attacker who owns one company on a shared installation to gain administrative control over another company by manipulating the companies[].id and companies[].role parameters. The flaw stems from improper access controls in the MemberService::create function, enabling unauthorized membership assignments across tenants.

Detection Guidance

Detecting this vulnerability requires checking InvoiceShelf versions and API interactions. Verify installed versions against 2.4.3/3.0.0-alpha.3. Monitor API logs for suspicious POST requests to /api/v1/members with manipulated companies[].id or companies[].role parameters. Look for unauthorized membership changes or role escalations in user accounts.

Impact Analysis

An attacker could exploit this to gain full administrative access to any company on the same InvoiceShelf installation. This grants access to sensitive financial data, ability to modify invoices, customers, payments, and invite additional users. The attack is remote and requires only ownership of one company on the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive financial and personal data across tenants, violating data protection requirements in GDPR and HIPAA. It compromises multi-tenancy isolation, potentially exposing protected health information or personal data to unauthorized parties.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.4 or 3.0.0-alpha.4 immediately. Apply the patch c798b513c3ab6e672a1678774720fbb282f4d0c6. Review and restrict API access to prevent unauthorized membership modifications. Audit existing user roles and company memberships for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...