CVE-2026-55384
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
Published Oct 14, 2026 · updated Oct 14, 2026 · InvoiceShelf InvoiceShelf
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, causing stored document totals to disagree with their item prices and quantities. This issue is fixed in version 2.4.0.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist
Affected
- vendor InvoiceShelf InvoiceShelfversion unspecified
Sources
- CVE.orgCVE-2026-55384
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_
cve.org - NIST NVDCVE-2026-55384
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_
nvd.nist.gov