{"schema":"threatline.record/2","record":{"id":"CVE-2026-55561","aliases":["GHSA-6xj3-274m-4mvg"],"summary":"InvoicePlane: Guest user IDOR in quote approval and rejection","details":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.","categories":["Unclassified"],"product":"InvoicePlane","vendor":"InvoicePlane","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55561","source_modified_at":"2026-10-28T22:33:47.140Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"InvoicePlane","vendor":"InvoicePlane","versions":[{"version":"< 1.7.2-beta-1","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T22:33:47.140Z","modified_at":"2026-10-28T22:33:47.140Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55561","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T22:33:47.140Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-6xj3-274m-4mvg","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/pull/1413","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/pull/1471","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/commit/424dc44eb54030b93176bb08cba07ba12d7ae451","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2-beta-1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T22:33:47.140Z","content_hash":"8ffe5706dceb7caf1fdd5c9e1bc697c1ec974a4f943f7b58aa305e41cc489de6"}}