CVE-2026-85291 InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::changepassword method accepts a userid from the URL and updates that account's password without an object-level authorization check. An authenticated secondary...

CVE-2026-85291

The self-hosted open source application InvoicePlane is vulnerable to a Horizontal Privilege Escalation (IDOR) in versions prior to 1.7.2 . The root cause is an object-level authorization check failure within the Users::change_password() method, which accepts a user_id from the URL. This allows a...