{"id":"CVE-2026-122158","kind":"vulnerability","aliases":["CVE-2026-122158"],"related":[],"title":"InvoiceShelf: member creation flaw lets users change company access roles","description":"A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.","summary":"InvoiceShelf, an open-source invoicing application, has an improper access control flaw in its member creation logic that accepts manipulated company IDs and roles. A remote attacker may be able to grant themselves access to companies they should not control.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["invoiceshelf","laravel","other","php","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the InvoiceShelf version in use; versions up to `2.4.3` and `3.0.0-alpha.3` are listed as affected.\n- Review `app/Domains/Accounts/Application/MemberService.php` for the `MemberService::create` function.","fix":"- Upgrade to `2.4.4` (2.x line).\n- Upgrade to `3.0.0-alpha.4` (3.x alpha line).","status":"open","published_at":"2026-11-05T02:16:58+00:00","first_seen_at":"2026-11-05T02:31:09+00:00","triaged_at":"2026-11-05T02:32:32+00:00","updated_at":"2026-11-05T02:32:32+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T02:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.4.4` (2.x line).\n- Upgrade to `3.0.0-alpha.4` (3.x alpha line).","reach":"internet","title":"InvoiceShelf: member creation flaw lets users change company access roles","impact":"medium","summary":"InvoiceShelf, an open-source invoicing application, has an improper access control flaw in its member creation logic that accepts manipulated company IDs and roles. A remote attacker may be able to grant themselves access to companies they should not control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["invoiceshelf","self-hosted","php","laravel"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker gains unauthorized access to company member roles","analyst_note":"Confirm whether an account is required and whether the exploit is public; check the vendor advisory and release notes for the exact fix details.","how_to_check":"- Check the InvoiceShelf version in use; versions up to `2.4.3` and `3.0.0-alpha.3` are listed as affected.\n- Review `app/Domains/Accounts/Application/MemberService.php` for the `MemberService::create` function.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that self-host InvoiceShelf and let users or administrators create company members can be affected, since the flaw is in how member creation handles the companies' IDs and roles. The sources do not say whether default configurations or authenticated access are required, so treat any exposed instance as in scope. Teams using managed hosting should confirm with their provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000745,"input_tokens":4397,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122158':13A,16A '-2026':12A,15A '/3.0.0-alpha.3':76C '2.4.3':75C '2.4.4':130C '3.0.0':132C 'abl':54B 'accept':43B 'access':9A,34B,58B,102C 'affect':77C,149C 'alpha.4':133C 'app/domains/accounts/application/memberservice.php':89C 'applic':30B 'argument':95C 'attack':51B,105C,126C 'c798b513c3ab6e672a1678774720fbb282f4d0c6':142C 'carri':110C 'chang':7A 'compani':8A,45B,60B,96C 'compon':150C 'control':35B,64B,103C 'creat':85C 'creation':3A,40B 'cve':11A,14A 'discov':70C 'exploit':114C 'file':88C 'flaw':4A,36B,67C 'function':83C 'grant':56B 'host':23B 'id':46B 'id/companies':97C 'improp':33B,101C 'invoic':29B 'invoiceshelf':1A,17B,24B,72C 'issu':80C,137C 'laravel':18B 'let':5A 'logic':41B 'manipul':44B,92C 'may':52B,122C 'member':2A,39B 'memberservic':84C 'name':141C 'open':27B 'open-sourc':26B 'patch':139C 'perform':90C 'php':20B 'possibl':107C 'public':120C 'recommend':145C 'releas':117C 'remot':50B,112C 'resolv':135C 'result':99C 'role':10A,48B,98C 'secur':66C 'self':22B 'self-host':21B 'sourc':28B 'upgrad':127C,147C 'use':124C 'user':6A 'version':129C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host InvoiceShelf and let users or administrators create company members can be affected, since the flaw is in how member creation handles the companies' IDs and roles. The sources do not say whether default configurations or authenticated access are required, so treat any exposed instance as in scope. Teams using managed hosting should confirm with their provider.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["invoiceshelf","laravel","medium","other","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-09-23T19:57:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122158","severity":null,"published_at":"2026-11-05T02:16:58+00:00","modified_at":"2026-11-05T02:16:58+00:00","first_seen_at":"2026-11-05T02:31:09+00:00","fetched_at":"2026-11-05T02:31:09+00:00","note":null}],"documents":[{"id":72244,"url":"https://github.com/InvoiceShelf/InvoiceShelf/commit/c798b513c3ab6e672a1678774720fbb282f4d0c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":72245,"url":"https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/3.0.0-alpha.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":72246,"url":"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-c9cx-7r7m-264v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-23T19:57:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}