CVE-2026-100392
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- Risk score
- 45/100
- CVSS
- 7.0 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-o…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.0 high
References
Original description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.
Last activity 28 Sep 2026. Patch Forecast updates every hour.