CVE-2026-122158: Privilege Escalation in InvoiceShelf

CVE-2026-122158 is an improper access controls vulnerability in InvoiceShelf, a billing and invoicing management platform for multi-tenant environments. The flaw resides in the MemberService::create function in file app/Domains/Accounts/Application/MemberService.php: by manipulating companies[].id and companies[].role parameters, a remote attacker can obtain privileges of other tenants hosted on the same instance. Affected versions are up to 2.4.3 and 3.0.0-alpha.3.

The vulnerability reports CVSS 4.7 (medium severity), but its impact is significant in multi-tenant contexts: an attacker could access data from other organizations managed by the same InvoiceShelf instance. According to official NVD data (2026-11-05), the exploit has been released publicly. The GitHub signal from 2026-11-06 confirms availability of proof-of-concept (PoC) code. The status is critical for users running vulnerable versions, given the public availability of exploitation code.

Administrators must upgrade immediately to InvoiceShelf 2.4.4 or 3.0.0-alpha.4 applying patch c798b513c3ab6e672a1678774720fbb282f4d0c6. Pending upgrade: verify if the instance is Internet-exposed; check access logs for anomalous patterns in companies[].id and companies[].role parameters; restrict access via firewall or VPN; monitor member creation operations for suspicious activity. No alternative mitigation is available; patching is the only defensive solution.