InvoiceShelf CVE-2026-55386

Requires an authenticated InvoiceShelf session (PR:L - any valid low-privilege user, which on a multi-tenant or self-registration deployment can be an untrusted outsider) against instances running a version prior to 2.4.0. The attacker supplies a crafted orderByField query parameter to invoice and other list endpoints whose Eloquent scopes (e.g., Invoice::scopeApplyFilters) pass the value straight into orderBy() without column-identifier validation. Limiting factors: exploitation is impossible without authentication, impact is confined to confidentiality via slow boolean-based blind data extraction (no write/modify or denial of service), and patched 2.4.0+ installs using SafeOrderBy::apply are not affected.

This is a genuine but moderate-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) confirms a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - i.e., an authenticated account - with high confidentiality impact and no integrity or availability impact, consistent with a boolean-based blind SQL injection limited to the ORDER BY clause (data read-out, not modification). The authentication requirement (PR:L) is the single biggest risk-reducer: this is not an unauthenticated internet-facing bug, so mass, drive-by exploitation is unlikely. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence, so there is no evidence of active exploitation or weaponization at this time - the signals are therefore not conflicting but simply sparse on the exploitation-likelihood side. The vendor advisory (GHSA-cp8p-jcqf-j39c), fix commit, and 2.4.0 release are confirmed, so remediation data is strong even though real-world threat telemetry is absent. Net: a real, patchable issue warranting prompt upgrade for exposed multi-tenant instances, but not an emergency 'patch-tonight' crisis given the authentication gate and the deployment footprint.

An attacker with a valid low-privilege InvoiceShelf account (e.g., a staff user or a self-registered tenant on a shared instance) sends a list request to an invoice or other list endpoint with a crafted orderByField query parameter containing a SQL expression. Because the value flows unsanitized into Laravel's orderBy() in scopeApplyFilters, the attacker performs boolean-based blind extraction to read data from the database character by character. No public exploit code was identified in the provided data, though the fix commit and PR publicly reveal the vulnerable code path.