CVE-2026-88003: InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because AdminController trusts the usertype snapshot stored in an existing session instead of revalidating ipusers.usertype. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set usertype back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
InvoicePlane deployments running versions before 1.7.2 are affected when an administrator downgrades an account that still has an active session. The downgraded account can retain administrative authorization through that existing session.
What must an attacker have to exploit it?
The attacker must be a user whose account previously had administrative privileges, must have an active session created while that role was assigned, and must then be downgraded by another administrator. They can use the retained authorization to change their user_type back to 1.
How can administrators tell whether a downgrade may have been bypassed?
Review accounts that were downgraded while logged in and determine whether their sessions remained active afterward. Affected accounts may have had their database role restored to user_type 1 through Users::form().
What can be done if upgrading is not immediately possible?
Ensure that users whose administrative roles are downgraded do not retain active sessions, since the issue depends on an existing session retaining the prior user_type snapshot. Upgrade to InvoicePlane 1.7.2 to apply the fix.