CVE-2026-55387

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

• CWE-284
• CWE-639

• https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47
• https://github.com/InvoiceShelf/InvoiceShelf/pull/661
• https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0
• https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62
• https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-wxrv-73x6-8r62

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55381InvoiceShelf is an open-source web & mobile app that helps t…7.1
• CVE-2026-55382InvoiceShelf is an open-source web & mobile app that helps t…7.6
• CVE-2026-55383InvoiceShelf is an open-source web & mobile app that helps t…8.2
• CVE-2026-55384InvoiceShelf is an open-source web & mobile app that helps t…5.3
• CVE-2026-55385InvoiceShelf is an open-source web & mobile app that helps t…6.8
• CVE-2026-55386InvoiceShelf is an open-source web & mobile app that helps t…7.1
• CVE-2026-55388piscina is a node.js worker pool implementation. Prior to 6.…8.1
• CVE-2026-55389datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-5539A flaw has been found in code-projects Simple Laundry System…4.3
• CVE-2026-55390datamodel-code-generator generates Python data models from s…7.5
• CVE-2026-55391datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-55392NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilf…5.5