CVE-2026-55387High· 7.2▾ MidnightPoC availableInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers with…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
— → 7.2
none → high
Exploit / PoC code exists
0.3%
0.3% → 0.4%
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55381High· 7.1InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-55382High· 7.6InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-55384Medium· 5.3InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-55386High· 7.1InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-55385Medium· 6.8InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-55383High· 8.2InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates