InvoicePlane <= 1.6.3 - Arbitrary File Read

InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest "Get::getfile" controller. The supplied filename is passed to readfile after a single urldecode with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the...

CVE-2026-25596

CVE-2026-25596 — Хранимый XSS через поле «Название единицы измерения продукта» в InvoicePlane 1.7.0 Уязвимость: Хранимый межсайтовый скриптинг XSS через поле «Название единицы измерения продукта» Продукт: InvoicePlane Затронутая версия: 1.7.0 и, вероятно, более ранние версии Степень серьезности:...

CVE-2026-25595

CVE-2026-25595 — InvoicePlane 1.7.0의 송장 번호를 통한 저장형 XSS 취약점: 송장 번호 필드를 통한 저장형 교차 사이트 스크립팅XSS 제품: InvoicePlane 영향을 받는 버전: 1.7.0및 이전 버전일 가능성 있음 심각도: 중간 CVSS 3.1 점수: 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79: 웹 페이지 생성 중 입력의 부적절한 중화 발견자: Leonidas Agathos 보고 날짜: 2026-01-31 설명 송장 양식의...

CVE-2026-25594

CVE-2026-25594 — Хранимый XSS через поле Family Name в InvoicePlane 1.7.0 Уязвимость: Хранимый межсайтовый скриптинг XSS через поле Family Name Продукт: InvoicePlane Затронутая версия: 1.7.0 и, вероятно, более ранние версии Серьёзность: Средняя Оценка CVSS 3.1: 4.8...

CVE-2026-25548

CVE-2026-25548 — Удалённое выполнение кода в InvoicePlane 1.7.0 Уязвимость: Удалённое выполнение кода через локальное включение файлов LFI + отравление журналов Log Poisoning Продукт: InvoicePlane Затронутая версия: 1.7.0 и, вероятно, более ранние версии Критичность: Критическая Оценка CVSS 3.1:...

CVE-2026-23491

CVE-2026-23491: InvoicePlane에는 Guest 컨트롤러에 인증되지 않은 경로 탐색 취약점이 있습니다 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-23491 심각도| 치명적 보안 권고| 보안 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 InvoicePlane/InvoicePlane 세부 내용 요약 InvoicePlane v1.6.3의 Guest 모듈 Get 컨트롤러에 있는 getfile 메서드에 경로 탐색path traversal 취약점이 존재합니다. 이 취약점으로 인해...

CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100371

The self-hosted open source application InvoicePlane (version 1.7.2) contains an incomplete authorization remediation that allows a secondary administrator to achieve full account takeover of the primary administrator (user_id=1). The vulnerability exists because while direct password changes are...

PT-2026-102342

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2 Description In the Users::form function, the application fails to perform an object-level authorization check on the user id variable when it is set to 1. This allows a Secondary Administrator to change the Primary...

PT-2026-102341

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the Users::change password function, the Users::form...

CVE-2026-100392: Incorrect Authorization

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100371: Incorrect Authorization

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...