CVE-2026-55384

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.

• CWE-284
• CWE-472

• https://github.com/InvoiceShelf/InvoiceShelf/commit/107a951126b606880a8f4838a88cdff707ee619b
• https://github.com/InvoiceShelf/InvoiceShelf/pull/665
• https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0
• https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-8c69-ch98-87r6

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55379Pillow is a Python imaging library. Prior to 12.3.0, PIL/Bdf…7.5
• CVE-2026-5538A vulnerability was detected in QingdaoU OnlineJudge up to 1…6.3
• CVE-2026-55380Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdI…7.5
• CVE-2026-55381InvoiceShelf is an open-source web & mobile app that helps t…7.1
• CVE-2026-55382InvoiceShelf is an open-source web & mobile app that helps t…7.6
• CVE-2026-55383InvoiceShelf is an open-source web & mobile app that helps t…8.2
• CVE-2026-55385InvoiceShelf is an open-source web & mobile app that helps t…6.8
• CVE-2026-55386InvoiceShelf is an open-source web & mobile app that helps t…7.1
• CVE-2026-55387InvoiceShelf is an open-source web & mobile app that helps t…7.2
• CVE-2026-55388piscina is a node.js worker pool implementation. Prior to 6.…8.1
• CVE-2026-55389datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-5539A flaw has been found in code-projects Simple Laundry System…4.3