CyberRota Analysis
AI-GeneratedInvoiceShelf versions prior to 2.4.1 are vulnerable to a cross-tenant access control flaw, allowing users designated as Owners to read and overwrite user accounts across different companies within the same installation. This vulnerability can lead to unauthorized disclosure of user data and full account takeover, including email/password changes and company reassignments. Organizations using InvoiceShelf in multi-company setups should prioritize upgrading to version 2.4.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue.