CVE-2026-55383: InvoiceShelf: Token type confusion exposes invoices and estimates of other companies

Summary

InvoiceShelf's public customer routes for invoices, estimates and payments accept an EmailLog token without verifying the document type, and the JSON routes do not enforce token expiry. An attacker holding a valid token can view a document of another company when numeric IDs collide, and expired tokens remain usable on the JSON endpoints. View requests can also mark an invoice or estimate as viewed and trigger a notification email to the company. No login is required, but a valid token is needed.

Affected

InvoiceShelf versions before 2.4.0
Sources differ on the exact lower bound; treat all versions below 2.4.0 as affected until the vendor advisory is confirmed.

Fixed in

Fixed in InvoiceShelf 2.4.0 (pull request #662, GHSA-73q7-2953-8gvx).
The vendor lists 2.4.7 as the latest stable release; use the newest 2.4.x.

Workaround

Unknown. No vendor workaround is documented.
Until patched, restrict public access to the customer portal where possible and shorten token lifetimes if the configuration allows.

Exploitation

CISA SSVC: exploitation status PoC, automatable: yes, technical impact: partial.
No evidence of active exploitation in the wild found; not listed in CISA KEV.

Our recommendation

Upgrade InvoiceShelf to the newest 2.4.x release.
If the installation is multi-company or the customer portal is internet-facing, prioritise the upgrade.
Review access logs for customer portal token requests to /customer/invoices, /customer/estimates and /customer/payments.
Restrict portal exposure until the update is applied.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CVE-2026-55383 Fix commit 5839d83 github.com
Pull Request #662 github.com
InvoiceShelf Release 2.4.0 github.com
GHSA-73q7-2953-8gvx Security Advisory github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:15.

Original description (NVD)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed