CVE-2026-55383

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55383

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55383.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55383

Aliases

GHSA-73q7-2953-8gvx

Published

2026-10-14T19:23:33Z

Modified

2026-10-15T10:47:32Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

Details

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55383.json"
}

References

Affected packages

Git / github.com/invoiceshelf/invoiceshelf

Affected ranges

Type

GIT

Repo

https://github.com/invoiceshelf/invoiceshelf

Events

Introduced

Fixed

e3ab12ad773749668dc64e029d265a8440e21477

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.2.2

1.3.0

2.*

2.0.0

2.0.0-RC1

2.1.0

2.1.0-RC1

2.1.1

2.2.0

2.2.1

2.3.0

2.3.1

2.3.2

2.3.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55383.json"