CVE-2026-55387

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55387

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55387.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55387

Aliases

GHSA-wxrv-73x6-8r62

Published

2026-10-14T19:21:49Z

Modified

2026-10-15T10:47:32Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

InvoiceShelf bulk deletion lacks company scoping

Details

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-284",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55387.json"
}

References

Affected packages

Git / github.com/invoiceshelf/invoiceshelf

Affected ranges

Type

GIT

Repo

https://github.com/invoiceshelf/invoiceshelf

Events

Introduced

Fixed

e3ab12ad773749668dc64e029d265a8440e21477

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.2.2

1.3.0

2.*

2.0.0

2.0.0-RC1

2.1.0

2.1.0-RC1

2.1.1

2.2.0

2.2.1

2.3.0

2.3.1

2.3.2

2.3.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55387.json"