CVE-2026-55561: InvoicePlane: Guest user IDOR in quote approval and rejection
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve() and reject() methods in the Guest Quotes controller, application/modules/guest/controllers/Quotes.php, call approvequotebyid($quoteid) and rejectquotebyid($quoteid) directly without the wherein('ipquotes.clientid', $this->userclients) scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer quoteid values, and emailquotestatus() also sends notification emails. Additionally, generatepdf() calls markviewed($quoteid) before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A guest user who is assigned to at least one client can exploit it. They can target quotes belonging to other clients by supplying sequential integer quote_id values.
What actions can an attacker perform?
An affected guest user can approve or reject another client's quote, which also triggers quote-status notification emails. They can also mark another client's quote as viewed through PDF generation.
Are guest users limited to their assigned clients on affected versions?
Not for quote approval, rejection, or the viewed-status update described here. The affected controller methods do not apply the client-scope check used by sibling methods.
Which versions contain the fix?
The issue is fixed in 1.7.2-beta-1 and in the subsequent stable release, 1.7.2.