CVE-2026-55382 InvoiceShelf CVE debrief

Who should care

Defenders managing InvoiceShelf installations, particularly those with multiple companies and staff users, should assess exposure and apply the patch. They should review staff user access controls and note management settings to prevent exploitation. Additionally, defenders should monitor for suspicious activity related to note modifications and implement compensating controls for exposed systems.

Why it matters

CVE-2026-55382 allows an authenticated staff user to read, modify, or delete notes from another company in InvoiceShelf due to missing company scope checks. Defenders should prioritize verifying exposure and applying the vendor's patch.

• Staff users with note management abilities can access sensitive information from other companies
• An attacker could modify or delete critical notes, affecting business operations
• Defenders must verify exposure and apply the vendor's patch to prevent exploitation
• Incident response may be required to investigate and mitigate potential breaches

Technical summary

The InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy methods do not properly check the company_id of the target note, allowing an authenticated staff user with ordinary note abilities to read, modify, or delete notes from another company. This issue arises due to missing company scope checks in the NotePolicy, which fails to validate the company_id of the note being accessed, modified, or deleted. As a result, an attacker can exploit this vulnerability to access sensitive information or disrupt business operations.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's patch, focusing on staff user access controls and note management.

Recommended defensive actions

• Verify exposure by checking if using InvoiceShelf versions prior to 2.4.0
• Apply the vendor's patch by upgrading to InvoiceShelf version 2.4.0
• Review staff user access controls and note management settings
• Monitor for suspicious activity related to note modifications
• Conduct a thorough review of note management and access controls
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed version 2.4.0. The vulnerability is caused by missing company scope checks in the NotePolicy, allowing an authenticated staff user with ordinary note abilities to read, modify, or delete notes from another company. The issue is fixed in version 2.4.0. Defenders should verify exposure and apply the vendor's patch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.