In InvoiceShelf, the bulk‑delete API validates record identifiers but fails to enforce that those identifiers belong to the authenticated user's company. An authenticated user can therefore supply another company's identifiers and delete records belonging to that other tenant, resulting in unintended data loss and integrity compromise. This flaw is an authorization issue (CWE‑284) and a validation problem (CWE‑639).

The vulnerability affects InvoiceShelf open‑source web and mobile applications with version 2.3.3 and earlier. The affected delete request validators are DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest. The problem was addressed in version 2.4.0.

The CVSS score of 7.2 classifies it as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session, but once authenticated the attacker can delete cross‑company data without further permissions, making the impact significant for organizations with multiple tenants.