CVE-2026-49850: InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::deleteinvoicetax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can be targeted by this issue?
An authenticated InvoicePlane administrator can be targeted if they load attacker-controlled content. The attacker can cause deletion of an invoice or invoice tax record through the administrator's active session.
What access does an attacker need?
The attacker does not need direct access to InvoicePlane, but must induce an authenticated administrator to load content that requests an affected route. Exploitation depends on the administrator having an active authenticated session.
Which deployments are affected?
InvoicePlane versions prior to 1.7.2 are affected. The vulnerable delete routes do not require a POST request or CSRF-token validation.
What should be done if an immediate upgrade is not possible?
The provided data identifies version 1.7.2 as the fix but does not specify a workaround. Until upgrading, reduce administrators' exposure to untrusted or attacker-controlled content while they are authenticated to InvoicePlane.