PT-2026-137314

CVE-2026-122158

Published

2026-11-05

Updated

2026-11-05

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.4.4 InvoiceShelf versions prior to 3.0.0-alpha.4

Description Improper access controls exist in the MemberService::create() function within the app/Domains/Accounts/Application/MemberService.php file. A remote attacker can exploit this by manipulating the companies[].id and companies[].role arguments.

Recommendations Upgrade to version 2.4.4. Upgrade to version 3.0.0-alpha.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-266: Incorrect Privilege Assignment

CWE-284: Improper Access Control

Related identifiers