InvoiceShelf’s public invoice, estimate, and payment routes accepted an EmailLog token that carried only a numeric mailable_id. The application did not check the mailable_type field and did not enforce token expiration. As a result, a token created for one document type could be used to retrieve another company’s documents when numeric identifiers collide, and expired tokens remained usable. The flaw also allowed an unauthorized party to mark mismatched invoices or estimates as viewed and trigger notifications. The vulnerability therefore enables confidential data leakage and potential disruption of notification workflows.

Versions of InvoiceShelf released before 2.4.0 are impacted. The attack vector originates from the public GET routes that serve customer invoices, estimates, and payments identified by an EmailLog token.

The CVSS score of 8.2 places the issue in the high severity range, underscoring a significant risk to confidentiality. EPSS information is not available, so the current probability of exploitation remains uncertain, but the public nature of the routes suggests that token discovery or guessing does not require privileged access. The vulnerability is not yet listed in the CISA KEV catalog, though its severity warrants close monitoring and timely remediation.