CVE-2026-85291
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- Risk score
- 42/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.7.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/InvoicePlane/InvoicePlane/commit/7af2cdd1138ab5e9cd4d95333180e617aecc86cf
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w
Original description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2.
Last activity 25 Sep 2026. Patch Forecast updates every hour.