CVE-2026-55387 InvoiceShelf CVE debrief

Who should care

Defenders managing InvoiceShelf instances, especially those with multi-company access, should assess exposure and apply remediation. This includes reviewing instance configurations, verifying exposure, and applying the vendor's remediation by upgrading to version 2.4.0 or later. Those responsible for security and vulnerability management within organizations using InvoiceShelf should prioritize verifying exposure and applying the necessary updates to and

Why it matters

Defenders should care about CVE-2026-55387 because it allows authenticated users to delete cross-company records in InvoiceShelf, potentially impacting data integrity and availability. Those managing InvoiceShelf instances, especially with multi-company access, should assess exposure and apply the vendor's remediation by upgrading to version 2.4.0 or later.

• Potential unauthorized deletion of cross-company records.
• Need to verify exposure and apply remediation.
• Possible impact on data integrity and availability.

Technical summary

InvoiceShelf's bulk-delete request validation does not consistently bind record identifiers to the authenticated user's company_id. This oversight allows an authenticated user to submit another company's identifier and delete cross-company records. The affected validators include DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest. The vulnerability is fixed in InvoiceShelf version 2.4.0, which properly scopes bulk deletions to the authenticated user's company.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's remediation for InvoiceShelf instances, especially where multi-company access is a use case.

Recommended defensive actions

• Verify InvoiceShelf instance exposure, especially where multi-company access is a use case.
• Apply the vendor's remediation by upgrading to version 2.4.0 or later.
• Monitor for suspicious bulk deletion activity.
• Review and update access controls for InvoiceShelf users.
• Track exceptions and retest remediated assets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The source item and supplemental sources offer additional context. Evidence is limited to public CVE Program and NVD records, which indicate that the vulnerability exists and has been fixed. Defenders should verify exposure by reviewing their instance configurations and applying the vendor's remediation. The vulnerability's impact is potentially severe, with possible unauthorized deletion of cross-company records, affecting data and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.