CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

EUVD-2026-88483

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

EUVD-2026-88481

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-100371

The self-hosted open source application InvoicePlane (version 1.7.2) contains an incomplete authorization remediation that allows a secondary administrator to achieve full account takeover of the primary administrator (user_id=1). The vulnerability exists because while direct password changes are...

CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

PT-2026-102342

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2 Description In the Users::form function, the application fails to perform an object-level authorization check on the user id variable when it is set to 1. This allows a Secondary Administrator to change the Primary...

PT-2026-102341

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the Users::change password function, the Users::form...

CVE-2026-100392: Incorrect Authorization

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100371: Incorrect Authorization

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

CVE-2026-88003

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

EUVD-2026-87352

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

CVE-2026-88003 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

CVE-2026-88003: Incorrect Authorization

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of...

PT-2026-99129

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to revoke administrative privileges immediately after a role downgrade. This occurs because the Admin Controller relies on the user type snapshot stored in an active session...