CVE-2026-85292: InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's UserController compares the session usertype value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
InvoicePlane versions before 1.7.2 are affected only when they use a non-standard session backend that can return unexpected scalar types for the session user_type value. The issue is described as defense-in-depth, so standard session behavior is not identified as affected.
What does an attacker need to exploit the authorization check?
Exploitation depends on the application receiving a session user_type value with an unexpected scalar type. PHP type juggling can then allow a value that is not strictly the required role to pass the check; no authentication or user interaction is required according to the supplied vector.
What is the remediation?
Upgrade InvoicePlane to version 1.7.2, which fixes the loose comparison in the User_Controller authorization check. If an immediate upgrade is not possible, review whether the configured session backend can return unexpected scalar types for user_type and avoid such behavior.