CVE-2026-55381

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55381
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55381.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55381
Aliases
  • GHSA-j2vg-rxqr-5vc9
Published
2026-10-14T19:24:20Z
Modified
2026-10-16T02:48:01Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates
Details

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55381.json"
}
References

Affected packages

Git / github.com/invoiceshelf/invoiceshelf

Affected ranges

Type
GIT
Repo
https://github.com/invoiceshelf/invoiceshelf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e432e4e62f5aa52238e3ff3fc37a0c78588eec47
Fixed
e3ab12ad773749668dc64e029d265a8440e21477
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.2.1
1.2.2
1.3.0
2.*
2.0.0
2.0.0-RC1
2.1.0
2.1.0-RC1
2.1.1
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55381.json"