{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ainvoiceshelfinvoiceshelf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.7,"id":"CVE-2026-122158"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InvoiceShelf (2.4.3, 3.0.0-alpha.3)"],"_cs_severities":["low"],"_cs_tags":["web-application","privilege-escalation","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["InvoiceShelf"],"content_html":"\u003cp\u003eInvoiceShelf contains a cross-tenant privilege escalation vulnerability (CVE-2026-122158) stemming from improper authorization checks during member creation and update operations. The application fails to validate that a company owner is authorized to manage memberships for companies other than their own, allowing an attacker to assign themselves or another account an arbitrary role (including 'owner') within a target tenant.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to InvoiceShelf as an owner of a legitimate tenant (Company A).\u003c/li\u003e\n\u003cli\u003eAttacker initiates a \u003ccode\u003ePOST\u003c/code\u003e or \u003ccode\u003ePATCH\u003c/code\u003e request to the member management API (\u003ccode\u003e/api/v1/members\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker includes a \u003ccode\u003ecompanies\u003c/code\u003e array in the request body containing the ID of a target victim tenant (Company B) and an elevated role assignment (e.g., \u003ccode\u003eowner\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application service layer processes the request.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMemberService::create()\u003c/code\u003e or \u003ccode\u003eupdate()\u003c/code\u003e methods receive the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe application performs a Bouncer authorization scope switch to the victim tenant ID without validating that the attacker is an owner of that specific company.\u003c/li\u003e\n\u003cli\u003eThe application synchronizes the attacker's account role with the victim company, granting the requested privilege.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to bypass tenant isolation, granting unauthorized access to financial records, customer data, and administrative settings of other tenants on the same installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade InvoiceShelf to version 2.4.4 or 3.0.0-alpha.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview system logs for unexpected membership changes or administrative role assignments occurring via API requests, specifically looking for \u003ccode\u003ePOST\u003c/code\u003e or \u003ccode\u003ePATCH\u003c/code\u003e requests to \u003ccode\u003e/api/v1/members\u003c/code\u003e containing cross-company IDs.\u003c/li\u003e\n\u003cli\u003eAudit existing tenant memberships for anomalous 'owner' roles assigned to accounts that should not have cross-tenant access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T02:20:35Z","date_published":"2026-11-06T02:20:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-invoiceshelf-privilege-escalation/","summary":"InvoiceShelf versions 2.4.3 and 3.0.0-alpha.3 are vulnerable to cross-tenant privilege escalation allowing an authenticated tenant owner to gain administrative control over other tenants on the same installation.","title":"InvoiceShelf: Cross-tenant privilege escalation (CVE-2026-122158)","url":"https://feed.craftedsignal.io/briefs/2026-11-invoiceshelf-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:invoiceshelf:invoiceshelf:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}