CVE-2026-26270: InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26270?
CVE-2026-26270 is classified as a moderate severity vulnerability due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2026-26270?
To fix CVE-2026-26270, it's recommended to update InvoicePlane to the latest version beyond 1.7.1 where the vulnerability has been patched.
Who is affected by CVE-2026-26270?
CVE-2026-26270 affects all users of InvoicePlane versions up to 1.7.1 who are authenticated and can input identifiers.
What type of vulnerability is CVE-2026-26270?
CVE-2026-26270 is a Stored Cross-Site Scripting (XSS) vulnerability that allows malicious scripts to be stored in the application.
Can CVE-2026-26270 lead to data compromise?
Yes, CVE-2026-26270 can potentially lead to data compromise as it allows an attacker to execute scripts in the context of authenticated users.