The vulnerability in InvoiceShelf allows an authenticated user to submit financial totals—such as the overall total, sub_total, tax, discount, and due amount—without server‑side verification against the line items. Because the values are accepted as supplied, a user can persist manipulated totals, causing stored invoices, estimates, or recurring invoices to report amounts that do not match the item prices, quantities, or calculated taxes. This injects incorrect financial data into the system, jeopardizing the integrity of financial records and exposing the business to potential financial loss or auditing issues. The weakness is a missing access control on total submission (CWE‑284) and improper validation of totals (CWE‑472).

Affected product is the InvoiceShelf web and mobile application. Versions before 2.4.0 of InvoiceShelf are vulnerable. The issue was fixed in release 2.4.0.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV, and no public exploit has been reported. Exploitation requires an authenticated user with permission to create or edit invoices, estimates, or recurring invoices. The attacker can issue a request that supplies crafted total values; the application will store them without cross‑checking, allowing the attacker to alter the financial totals of any document they can edit. Because the payload is accepted by the request handlers InvoicesRequest::getInvoicePayload and the corresponding estimates and recurring‑invoice handlers, an attacker can simply use the normal web interface or API to submit the manipulated totals. Mitigation is straightforward once the vendor releases the patched version, after which the application performs server‑side validation of the totals against line items.