InvoiceShelf: Cross-tenant privilege escalation (CVE-2026-122158)

InvoiceShelf contains a cross-tenant privilege escalation vulnerability (CVE-2026-122158) stemming from improper authorization checks during member creation and update operations. The application fails to validate that a company owner is authorized to manage memberships for companies other than their own, allowing an attacker to assign themselves or another account an arbitrary role (including 'owner') within a target tenant.

Attack Chain

1. Attacker authenticates to InvoiceShelf as an owner of a legitimate tenant (Company A).
2. Attacker initiates a POST or PATCH request to the member management API (/api/v1/members).
3. Attacker includes a companies array in the request body containing the ID of a target victim tenant (Company B) and an elevated role assignment (e.g., owner).
4. The application service layer processes the request.
5. The MemberService::create() or update() methods receive the malicious payload.
6. The application performs a Bouncer authorization scope switch to the victim tenant ID without validating that the attacker is an owner of that specific company.
7. The application synchronizes the attacker's account role with the victim company, granting the requested privilege.

Impact

Successful exploitation allows an authenticated user to bypass tenant isolation, granting unauthorized access to financial records, customer data, and administrative settings of other tenants on the same installation.

Recommendation

• Upgrade InvoiceShelf to version 2.4.4 or 3.0.0-alpha.4 or later immediately.
• Review system logs for unexpected membership changes or administrative role assignments occurring via API requests, specifically looking for POST or PATCH requests to /api/v1/members containing cross-company IDs.
• Audit existing tenant memberships for anomalous 'owner' roles assigned to accounts that should not have cross-tenant access.