CVE-2026-85292 Details
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2.
A vulnerability exists in InvoicePlane's User_Controller authentication mechanism, prior to version 1.7.2. The issue arises from the use of PHP's loose inequality operator in session user type comparisons, which can lead to type juggling. In non-standard session backends that return unexpected scalar types, this could allow a value that does not strictly match the required role to bypass authorization checks. As a result, authentication or authorization could be improperly circumvented under affected session configurations.
Users are advised to upgrade to InvoicePlane version 1.7.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane/commit/efa9f576faa93ba64bef52b09b119e81a5b22fcf | [email protected] | Source CodeVendor |
| https://github.com/InvoicePlane/InvoicePlane/pull/1640 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-346c-gqqq-mrm2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoicePlane | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |