CVE-2026-85291: InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::changepassword() method accepts a userid from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated secondary administrator can exploit it. The attacker needs access to a secondary administrator account but does not need to know the primary administrator's current password.
Which deployments are affected?
InvoicePlane versions prior to 1.7.2 are affected. The vulnerable password-change behavior is in the Users::change_password() method.
What is the impact of successful exploitation?
A secondary administrator can change the primary administrator's password, take over that account, and gain access to its data and privileges.
What should be done to remediate the issue?
Upgrade InvoicePlane to version 1.7.2, which fixes the missing object-level authorization check.