Improper access control in InvoiceShelf member creation
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-284.
Summary
InvoiceShelf up to 2.4.3 and 3.0.0-alpha.3 has an improper access control flaw (CWE-284) in the MemberService::create function. Manipulating the companies[].id and companies[].role arguments results in improper access controls, and a remote attacker with high privileges can trigger it. A public exploit has been released.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | InvoiceShelf | 2.4.0; 2.4.1; 2.4.2; 2.4.3; 3.0.0-alpha.0; 3.0.0-alpha.1; 3.0.0-alpha.2; 3.0.0-alpha.3 | 2.4.4, 3.0.0-alpha.4 | Patch available | CNA |
- InvoiceShelf Vendor— Affected 2.4.0; 2.4.1; 2.4.2; 2.4.3; 3.0.0-alpha.0; 3.0.0-alpha.1; 3.0.0-alpha.2; 3.0.0-alpha.3 Fixed in 2.4.4, 3.0.0-alpha.4 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:* | — | — | InvoiceShelf |
- cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:* Versions — — ·InvoiceShelf
Remediation
Upgrade InvoiceShelf to version 2.4.4 or 3.0.0-alpha.4. The fix is available in patch c798b513c3ab6e672a1678774720fbb282f4d0c6.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA InvoiceShelf Fixed in 2.4.4, 3.0.0-alpha.4
Timeline
- 2026-11-05 Threatist record created from CVE-2026-122158
- 2026-11-05 Alias added: GHSA-m3f2-9g2h-fgj9
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
References
Patch 3
Sources
- CVE-2026-122158 · CVE Program
- CVE-2026-122158 · NVD
- FIRST EPSS
- GHSA-m3f2-9g2h-fgj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences