CVE-2026-85289: InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest() from delete methods including Payments::delete(), Recurring::delete(), and Userclients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running InvoicePlane versions earlier than 1.7.2 are affected. Exploitation targets an authenticated administrator through their browser.
What does an attacker need to exploit it?
The attacker does not need application credentials, but must cause an authenticated administrator to submit a cross-origin form. The vulnerable delete routes accept POST requests without validating a CSRF token.
Which actions can be triggered?
The affected delete methods include Payments::delete(), Recurring::delete(), and User_clients::delete(). Successful exploitation can delete financial records and other application data.
How can this be remediated?
Upgrade InvoicePlane to version 1.7.2, which adds the missing CSRF validation for the affected delete endpoints.