CVE-2026-55561

Prior to version 1.7.2-beta-1 , the InvoicePlane application is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Guest Quotes controller (application/modules/guest/controllers/Quotes.php). The approve() and reject() methods call approve_quote_by_id($quote_id) and reje...