CVE-2026-55383 InvoiceShelf CVE debrief

Who should care

Defenders responsible for InvoiceShelf deployments should assess their exposure and prioritize upgrading to version 2.4.0 or later. They should also review their current deployment to ensure that only authorized personnel have access to sensitive financial documents.

Why it matters

Defenders should care about CVE-2026-55383 because it allows for cross-company invoice disclosure in InvoiceShelf prior to version 2.4.0. The vulnerability can be exploited through token type confusion and misuse of expired tokens, potentially leading to unauthorized disclosure of financial documents.

• Potential unauthorized disclosure of financial documents
• Possible misuse of expired tokens
• Need for verification of token type and expiration
• Requirement for access controls on sensitive routes

Technical summary

The vulnerability in InvoiceShelf prior to version 2.4.0 allows for cross-company invoice disclosure due to a token type confusion in the EmailLog functionality. Tokens issued for one document type can be used to disclose documents of a different type if their numeric identifiers collide. Expired tokens can also still be used on certain JSON routes. This issue arises from the use of an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers not enforcing EmailLog::isExpired. Defenders should prioritize upgrading to InvoiceShelf version 2.4.0 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize upgrading to InvoiceShelf version 2.4.0 or later to mitigate this vulnerability. They should also review their current deployment to ensure that only authorized personnel have access to sensitive financial documents.

Recommended defensive actions

• Upgrade to InvoiceShelf version 2.4.0 or later
• Review and restrict access to sensitive financial documents
• Monitor for suspicious activity on invoice, estimate, and payment routes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was discovered in InvoiceShelf's public customer invoice, estimate, and payment routes. The issue arises from the use of an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers not enforcing EmailLog::isExpired.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.