Read the docs
TI-2026-74459 Aliases CVE-2026-55383

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

Priority HIGH 75CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed InvoiceShelf (InvoiceShelf): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InvoiceShelfInvoiceShelfbefore 2.4.02.4.0Patch availableCNA
  • InvoiceShelf VendorInvoiceShelf Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:*——InvoiceShelf
  • cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:* Versions — — ·InvoiceShelf

Remediation

  • Fix · CNA InvoiceShelf (InvoiceShelf) Fixed in 2.4.0

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-55383

References

Other 4

  • TI-2026-26653 InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field CVSS 3.1HIGH 8.7
  • TI-2026-26652 InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field CVSS 3.1HIGH 8.1
  • TI-2026-26651 InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field CVSS 3.1HIGH 8.1
  • TI-2026-74463 InvoiceShelf bulk deletion lets users delete other companies' records CVSS 4.0HIGH 7.2
  • TI-2026-74462 SQL injection in InvoiceShelf ORDER BY clause exposes database data CVSS 4.0HIGH 7.1
  • TI-2026-74457 Missing access check in InvoiceShelf estimate conversion CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences