Vendor
InvoiceShelf versions 2.4.3 and 3.0.0-alpha.3 are vulnerable to cross-tenant privilege escalation allowing an authenticated tenant owner to gain administrative control over other tenants on the same installation.