Privilege Escalation in InvoiceShelf Multi-Company

Executive Summary

CVE-2026-55610 is an Insecure Direct Object Reference (IDOR) flaw in InvoiceShelf, a self-hosted invoicing app. It affects multi-company installations where an Owner of one company can read or modify user accounts in other companies on the same instance. The issue occurs because the /api/v1/users/{user} endpoint does not verify if the target user belongs to the requester's company.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to /api/v1/users/{user} endpoints where the requester's company ID does not match the target user's company ID. Check application logs for unauthorized access attempts to user data across different companies.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to read sensitive user data (name, email, company details) from other companies. They can also overwrite a victim's email and password to take over their account. Additionally, the attacker can reassign the victim to their own company with super-admin privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data across different companies, violating GDPR's principles of data minimization and purpose limitation. It may also breach HIPAA if protected health information is exposed or improperly accessed.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.1 or later. Review UserPolicy class to ensure company membership checks are enforced for view, update, and related methods. Restrict API access to prevent cross-tenant data exposure until patched.

Useful 0 Not Useful 0