CVE-2026-55610: InvoiceShelf Auth Bypass Vulnerability

CVE-2026-55610 Overview

InvoiceShelf is an open-source web and mobile application for tracking expenses, payments, invoices, and estimates. CVE-2026-55610 affects multi-company installations of InvoiceShelf prior to version 2.4.1. The flaw allows any user holding the Owner role in one company to read and overwrite user accounts belonging to other companies on the same installation. The GET/PUT /api/v1/users/{user} endpoint resolves the target user by global primary key, while UserPolicy only verifies that the requester owns their own header-company. It never confirms that the target user belongs to that company, enabling cross-tenant data disclosure and full account takeover.

Critical Impact
An authenticated Owner in one tenant can overwrite the email, password, and company assignment of any user across all tenants on the same InvoiceShelf installation.

Affected Products

InvoiceShelf multi-company installations prior to version 2.4.1
InvoiceShelf web application
InvoiceShelf REST API (/api/v1/users/{user} endpoint)

Discovery Timeline

2026-09-23 - CVE-2026-55610 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55610

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) classified as [CWE-639] Authorization Bypass Through User-Controlled Key. InvoiceShelf supports multi-company deployments where users are scoped to companies through a header-based context. The UserPolicy authorization layer confirms the caller is an Owner within the company identified by their request header. However, the policy does not validate that the {user} route parameter references a user belonging to that same company.

Because the API resolves users by global primary key, an authenticated Owner can iterate or guess numeric identifiers to reference users belonging to other tenants. The PUT variant of the endpoint accepts writes to email, password, and company assignment fields, enabling full account takeover and cross-tenant privilege manipulation.

Root Cause

The root cause is missing tenant-scoping in the authorization check. The UserPolicy grants access based solely on the requester's ownership of their own company, without correlating the requester's tenant with the tenant of the target resource. The controller compounds the flaw by resolving User objects globally rather than filtering the query by the acting company.

Attack Vector

An attacker requires an authenticated Owner account on a single tenant of a shared InvoiceShelf installation. The attacker sends GET /api/v1/users/{id} requests, incrementing {id} to enumerate users across all tenants and disclose account data. To take over an account, the attacker issues PUT /api/v1/users/{id} with a new email and password, then re-assigns company membership. No user interaction is required, and the attack executes entirely over the network.

See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-55610

Indicators of Compromise

Sequential or enumerative GET /api/v1/users/{id} requests from a single authenticated session targeting user IDs outside the caller's company scope.
PUT /api/v1/users/{id} requests that modify the email, password, or company_id fields for users not belonging to the requester's tenant.
Unexpected password reset notifications or login failures reported by users across multiple tenants on a shared installation.
Audit log entries showing user record modifications where the acting user's company differs from the target user's company.

Detection Strategies

Parse application logs and correlate the header-company of the requester against the tenant of the modified User record for every /api/v1/users/{user} call.
Alert on any Owner account issuing high-volume enumeration of the /api/v1/users/{id} endpoint within a short interval.
Baseline normal write patterns to /api/v1/users/{id} per tenant and flag deviations, especially cross-tenant writes.

Monitoring Recommendations

Ingest InvoiceShelf web server and application logs into a centralized analytics platform for tenant-boundary correlation.
Monitor database audit trails on the users table for updates where the acting session's company_id does not match the target row's company_id.
Track authentication anomalies such as logins from unfamiliar IPs immediately following email or password changes.

How to Mitigate CVE-2026-55610

Immediate Actions Required

Upgrade all InvoiceShelf multi-company installations to version 2.4.1 or later without delay.
Audit the users table for unauthorized email, password hash, or company_id changes since the installation was deployed.
Force a password reset for all users and invalidate active API tokens and sessions after upgrading.
Review the roster of Owner-role accounts across every tenant and revoke any that are unnecessary or untrusted.

Patch Information

InvoiceShelf version 2.4.1 fixes the issue by enforcing tenant-scoped authorization in UserPolicy and scoping the User lookup to the acting company. Refer to the GitHub Security Advisory GHSA-vgx6-6cqr-m8qr for the official fix details.

Workarounds

Restrict network access to the InvoiceShelf API to trusted operators until the upgrade is complete.
Temporarily consolidate to single-tenant deployments per host, since the flaw only affects shared multi-company installations.
Place a reverse proxy rule in front of /api/v1/users/{id} that requires manual approval for write operations until patched.

bash

# Upgrade InvoiceShelf to the patched release
git fetch --tags
git checkout v2.4.1
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:clear
php artisan cache:clear