InvoiceShelf, an expense tracking and invoicing platform, contains a critical IDOR flaw in its multi‑company installations. The API endpoint GET/PUT /api/v1/users/{user} fails to verify that the target user belongs to the requester's company, allowing a company Owner to read and overwrite any user account in any other company on the same installation. The vulnerability enables full account takeover, including email/password overwrite and reassignment of the victim to a different company. The weakness is a classic information disclosure and privilege escalation failure, classified as CWE‑639.

All installations of InvoiceShelf older than version 2.4.1 are vulnerable. The software is deployed in open‑source web and mobile environments that support multiple tenant companies. The issue is present only when a user holds an "Owner" role for one company while also having access to the shared installation.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a proposal or mitigation does not diminish the risk. The attack can be carried out remotely by an authenticated user who has Owner rights in any company on the installation, and the exploit requires only standard API calls with the owner’s credentials. Because the flaw is an IDOR, it can be triggered without special privileges beyond the legitimate Owner role, implying a low technical barrier to exploitation and a wide threat surface within organizations that host multiple tenants on a single InvoiceShelf instance.