CVE-2026-85292

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's UserController compares the session usertype value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns...

CVE-2026-85292 InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's UserController compares the session usertype value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns...

CVE-2026-85292

In InvoicePlane versions prior to 1.7.2 , a loose type comparison in the User_Controller allows for potential authentication or authorization bypass . The application uses PHP's loose inequality operator to compare the session user_type value against the required role. In specific configurations ...