Answer in brief
CVE-2026-55381 records a High severity (CVSS 7.1) vulnerability in InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates. The current sources do not mark it as known exploited. The current feed maps InvoiceShelf/InvoiceShelf (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps InvoiceShelf/InvoiceShelf (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| InvoiceShelf/InvoiceShelfgeneric | <2.4.0 | 2.4.0 |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.
Quoted source text, attributed separately from HOL analysis.