CVE-2026-55382

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

CVE-2026-55382 InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

CVE-2026-55382 InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

CVE-2026-55382

Prior to version 2.4.0 , the InvoiceShelf web and mobile application is vulnerable to Broken Object Level Authorization (BOLA/IDOR) . The NotesController::show, NotesController::update, and NotesController::destroy actions fail to pass the route-bound Note object to NotePolicy::viewNotes or NoteP...

PT-2026-114209

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

CVE-2026-55382: Authorization Bypass Through User-Controlled Key

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

PT-2026-68108

Name of the Vulnerable Software and Affected Versions Crater affected versions not specified Description An Insecure Direct Object Reference IDOR exists because the NotePolicy only verifies general Bouncer abilities manage-all-notes or view-all-notes without confirming if the user belongs to the...