CVE-2026-88003

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

CVE-2026-88003 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

CVE-2026-88003 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...