CVE-2026-85291 Details
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2.
A vulnerability in InvoicePlane's Users module prior to version 1.7.2 allows for unauthorized password changes. The Users::change_password() method can be exploited by an authenticated secondary administrator to change the password of the primary administrator account without knowledge of the current password. This is achieved by sending a POST request to the password change endpoint with the desired new password. The vulnerability arises from a lack of object-level authorization checks, as the method only verifies if the requester is an admin, not whether they have permission to change the password for the specified user.
Users can upgrade to InvoicePlane version 1.7.2, which addresses this vulnerability by restricting password changes to the user's own account or requiring verification of the current password.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoicePlane/InvoicePlane/commit/7af2cdd1138ab5e9cd4d95333180e617aecc86cf | [email protected] | Source CodeVendor |
| https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoicePlane | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |