A flaw in the MemberService::create function allows manipulation of the companies[].id/companies[].role arguments, resulting in improper access controls. An attacker can insert arbitrary company identifiers or assign roles that bypass normal authorization checks. The vulnerability permits an attacker to create or modify member associations that should otherwise be restricted, potentially granting unauthorized access to sensitive data or services. The flaw is exploitable remotely, and the public exploit code has been released.

The issue affects the InvoiceShelf application, specifically software versions up to 2.4.3 and 3.0.0-alpha.3. The vulnerable code resides in app/Domains/Accounts/Application/MemberService.php and is present in all affected releases of the product.

The CVSS score of 5.1 indicates a medium severity impact, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, suggesting that no current data indicates high exploitation probability, but the fact that public exploit code exists means the risk could be higher than the score alone suggests. The attack can be carried out remotely without prior authentication, and once successful, an attacker can create or alter member relationships in the system, potentially leading to privilege escalation or unauthorized data access.