---
id: "CVE-2026-122158"
kind: "vulnerability"
aliases: ["CVE-2026-122158"]
title: "InvoiceShelf: member creation flaw lets users change company access roles"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["invoiceshelf", "laravel", "other", "php", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-05T02:16:58+00:00"
first_seen_at: "2026-11-05T02:31:09+00:00"
updated_at: "2026-11-05T02:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122158", "first_seen_at": "2026-11-05T02:31:09+00:00"}]
exploit_sources: []
---

# InvoiceShelf: member creation flaw lets users change company access roles

InvoiceShelf, an open-source invoicing application, has an improper access control flaw in its member creation logic that accepts manipulated company IDs and roles. A remote attacker may be able to grant themselves access to companies they should not control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the InvoiceShelf version in use; versions up to `2.4.3` and `3.0.0-alpha.3` are listed as affected.
- Review `app/Domains/Accounts/Application/MemberService.php` for the `MemberService::create` function.

## Fix

- Upgrade to `2.4.4` (2.x line).
- Upgrade to `3.0.0-alpha.4` (3.x alpha line).

## Timeline

- 2026-11-05T02:31:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122158

## Documents

- [advisory] Vendor advisory: github.com https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-c9cx-7r7m-264v
- [fix] Patch: github.com https://github.com/InvoiceShelf/InvoiceShelf/commit/c798b513c3ab6e672a1678774720fbb282f4d0c6
- [fix] Release notes: github.com https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/3.0.0-alpha.4

## From the sources

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_