Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55386: InvoiceShelf can expose database data through sort parameter

CVE-2026-55386 · published 21 days ago

Summary

InvoiceShelf versions before 2.4.0 let a logged‑in user change the sorting option on list pages so that the system runs unintended database commands and can leak hidden data. This could let an attacker quietly gather confidential information. Upgrade to version 2.4.0 or later to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
invoiceshelf	invoiceshelf	< 2.4.0

Original advisory text

InvoiceShelf ORDER BY SQL injection through orderByField

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

References

https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-... Vendor Advisory
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f7... Patch
https://github.com/InvoiceShelf/InvoiceShelf/pull/663 Patch
https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55386... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-55386 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published14 Oct 2026

Updated4 Nov 2026

First seen14 Oct 2026

Sources

CVE-2026-55386 · NVD

CVE-2026-55386 · MITRE

CVE-2026-55386 · OSV

GHSA-cp8p-jcqf-j39c · GHSA

Track software like this

Free during beta