CVE-2026-85274 Details
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. This issue is fixed in version 1.7.2.
A cross-site request forgery (CSRF) vulnerability has been identified in InvoicePlane, an open-source application for managing invoices and payments. Prior to version 1.7.2, the application allowed authenticated administrators to stop recurring invoices via a GET request to the 'Recurring::stop()' method, without any validation of CSRF tokens. This flaw could be exploited by embedding an image tag in content viewed by an admin, silently halting recurring billing and causing financial loss. The issue arises because the 'Base_Controller' only restricts GET requests to URLs containing 'delete', leaving the 'stop' endpoint unprotected. This vulnerability affects InvoicePlane versions through 1.7.1.
Users are advised to upgrade to InvoicePlane version 1.7.2, which addresses this vulnerability by adding proper CSRF protection to the 'Recurring::stop()' method.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-qf9q-2hxm-4wh9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoicePlane/InvoicePlane/commit/2c76ef5655c2c188110a9c1932338e6a3022ea20 | [email protected] | Source CodeVendor |
| https://github.com/InvoicePlane/InvoicePlane/pull/1636 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-qf9q-2hxm-4wh9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoicePlane | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |