CVE-2026-100392: InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on userid = 1. A Secondary Administrator (usertype = 1, userid != 1) can rewrite the Primary Administrator's usertype to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A Secondary Administrator account with user_type = 1 and a user_id other than 1 can exploit it. The attacker must be able to access the Users::form() functionality and modify the primary administrator record.
Is a default installation affected?
An instance is affected if it runs InvoicePlane 1.7.2 and has a Secondary Administrator account. The vulnerable condition specifically concerns the primary administrator account, user_id = 1.
What is the impact of successful exploitation?
An attacker can change the primary administrator's user_type to 2, the Guest/read-only role. This removes the root account's administrative privilege and can lock the legitimate owner out of the instance.
What can be done if patching is not available?
No publicly available patches were available at publication. Restrict or remove Secondary Administrator access where operationally possible, since those accounts are identified as capable of changing the primary administrator's role.