InvoiceShelf NotesController actions authorise only generic note abilities and do not verify the target note’s company affiliation. As a result, any authenticated staff user can supply another company’s sequential note identifier and read, edit, or delete that company’s reusable templates. The flaw permits confidentiality loss and integrity compromise of note data across corporate boundaries, and it is a classic BOLA/IDOR vulnerability. The weakness is reflected by CWE‑639. The exploitation is trivial for an authenticated user because the application performs no further permission checks on the record being accessed.

InvoiceShelf versions older than 2.4.0 are affected. The Note model in these releases lacks a global company scope, allowing cross‑company access. An authenticated staff user with ordinary note abilities can target any company’s notes by guessing or enumerating note identifiers.

The CVSS score of 7.6 indicates a medium‑high severity vulnerability. EPSS information is unavailable, and the issue is not currently listed in CISA KEV, suggesting a moderate to low likelihood of widespread exploitation on the internet. Nonetheless, the attack vector is straightforward: an authenticated user crafts a request to the NotesController with a note ID belonging to another company. Because the application does not enforce scoping, the request succeeds, granting read, modify, or delete rights over another company’s data.