An authorization bypass vulnerability in InvoiceShelf allows authenticated owners to perform unauthorized cross-tenant data access and account takeover, posing a severe risk to multi-company environments.

This is an authorization bypass flaw (CWE-639) occurring within the API endpoints /api/v1/users/{user}. The system fails to verify that the target user belongs to the requester's company, allowing any authenticated user with Owner privileges to manipulate user records globally across all tenants.

The ability for a malicious actor to perform cross-tenant data disclosure and full account takeover represents a catastrophic failure of multi-tenant isolation. With a CVSS score of 8.7, this vulnerability facilitates unauthorized access to sensitive financial and user information, potentially leading to widespread data breaches and loss of tenant trust.

Immediate Action: Upgrade InvoiceShelf to version 2.4.1 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review API access logs for suspicious GET or PUT requests directed at the /api/v1/users/ endpoint, specifically looking for attempts to access user IDs outside of known company ranges.

Compensating Controls: Implement strict API gateway rules or Web Application Firewall (WAF) policies to limit access to sensitive user management endpoints if an immediate update is not feasible.

Public Exploit Available: No

Given the high CVSS severity and the direct impact on tenant isolation, this vulnerability poses a significant risk to multi-company deployments. Organizations must prioritize upgrading to version 2.4.1 to ensure that user access is correctly scoped to their respective tenants and to prevent unauthorized account takeovers.