All vulnerabilities
CVE-2026-100392GHSA-4fxw-x7wr-x6qc

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane InvoicePlane
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published28 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.

Text from CVE List

Affected versions 2

  • InvoicePlaneaffected: = 1.7.2CVE List
  • invoiceplane/invoiceplane, composer1.7.2GitHub

References 1