How one Owner could take over any account in another company — cross-tenant IDOR in InvoiceShelf (CVE-2026-55610)
php
dev.to
TL;DR InvoiceShelf (self-hosted, multi-company invoicing) let any company Owner read and overwrite any user in any other company on the same installation. GET/PUT /api/v1/users/{id} resolved the user by global primary key, and the policy only checked that you own your header-company — never that the target belonged to it. Result: cross-tenant account takeover (overwrite email + password, and re-assign the victim into your company as super-admin). High, CVSS 8.7 (CWE-639). Fixed in