The vulnerability is an IDOR in the estimate‑to‑invoice conversion route that allows any authenticated user with the create‑invoice privilege to invoke POST /api/v1/estimates/{estimate}/convert‑to‑invoice using any estimate ID. The controller only verifies the caller’s ability to create invoices, not that the estimate belongs to the caller’s company. An attacker can therefore view and copy all data from another company’s estimate—including line items, pricing, totals, taxes, notes, currency and customer details—and create a new invoice in their own company. The victim company’s conversion logic can also manipulate or delete the original estimate, compromising data integrity and potentially availability. This is an authorization bypass (CWE‑639).

InvoiceShelf, the open‑source expense and invoicing application, is affected. All releases before version 2.4.0 contain the flaw; it was fixed in release 2.4.0 and later.

The CVSS score of 7.1 indicates a high‑severity vulnerability. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the authenticated API endpoint that requires the create‑invoice permission. Because the flaw permits internal users with that permission to access and manipulate estimates from other companies, it can be exploited in trusted environments unless mitigated. The missing access check on the estimate resource is the core weakness (CWE‑639).