CVE-2026-122158 | InvoiceShelf up to 2.4.3/3.0.0-alpha.3 MemberService.php MemberService::create companies[].id/companies[].role access control (GHSA-c9cx-7r7m-264v)

November 4, 2026 Yanac

A vulnerability classified as problematic has been found in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls.

This vulnerability is reported as CVE-2026-122158. The attack is possible to be carried out remotely. Moreover, an exploit is present.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More