InvoiceShelf Token Bypass Allows Cross-Document Data Exposure Before v2.4.0

InvoiceShelf, an open-source application for tracking expenses and generating invoices, contains a high-severity authorization flaw in versions older than 2.4.0. The issue, tracked as CVE-2026-55383, allows unauthorized access to sensitive business documents through public customer routes. This defect exposes environments that rely on these default endpoints without additional network segmentation or strict access controls.

Root cause

The vulnerability arises because the application fails to verify the `mailable_type` when processing an `EmailLog` token’s numeric `mailable_id`. Additionally, the JSON handlers do not enforce the `EmailLog::isExpired` check. This means the system accepts tokens that should be invalid or tokens intended for different document types. According to the NVD record, this lack of validation creates a pathway for data leakage when identifier numbers overlap.

Attack path

An attacker can use a token issued for one document type to disclose a different company’s document if the numeric identifiers collide. Expired tokens remain usable on specific JSON routes, including `GET /customer/invoices/{email_log:token}`, `GET /customer/estimates/{email_log:token}`, and `GET /customer/payments/{email_log:token}`. View handlers may also mark mismatched invoices or estimates as viewed, triggering notifications that could alert the victim to the intrusion attempt.

Affected versions

• InvoiceShelf versions prior to 2.4.0 are affected by this vulnerability.
• The issue is present in the public customer invoice, estimate, and payment routes.
• No other version ranges are mentioned in the source material.

Mitigation

• Upgrade InvoiceShelf to version 2.4.0, which fixes this issue according to the vendor.
• If immediate upgrade is not possible, restrict access to the public customer routes at the network level.
• Monitor logs for unusual access patterns on invoice and estimate endpoints.
• Review token generation logic to ensure strict type and expiration validation.

Signals worth monitoring

Teams usually check web server access logs for repeated requests to customer invoice and estimate endpoints using tokens that do not match expected user sessions. Analysts should look for notifications triggered by view events on documents that were not recently accessed by the owner. Security operations centers often correlate these alerts with failed authentication attempts or unusual geographic sources. Containment typically involves blocking the source IP and revoking active tokens if the platform supports it.

What to do and how to stay safe: InvoiceShelf

• Update your InvoiceShelf installation to version 2.4.0 or later to apply the official fix.
• Audit your server logs for any unauthorized access to public customer routes before patching.
• Restrict access to invoice and estimate endpoints to trusted IP ranges if possible.
• Once the vendor provides an update, test it in a staging environment before deploying to production.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-55383?

The CVSS score is 8.2, which is classified as HIGH severity.

Which routes are vulnerable to this token bypass?

The vulnerable routes are GET /customer/invoices, GET /customer/estimates, and GET /customer/payments.

Is there a fix available for this vulnerability?

Yes, the issue is fixed in InvoiceShelf version 2.4.0.