CVE-2026-55610

HighCVSS 8.7/10Last modified Sep 23, 2026

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
InvoiceShelf	InvoiceShelf	< 2.4.1

References

https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-556110.0AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti CVE-2026-556123.7uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length l CVE-2026-556136.9uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundarie CVE-2026-556146.9uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares CVE-2026-556159.2Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated CVE-2026-556176.9Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj CVE-2026-556186.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556195.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-55629.8A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/tes CVE-2026-556207.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556217.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copyin CVE-2026-556227.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying whe