CVE-2026-85274 in InvoicePlane
Summary
by MITRE • 09/25/2026
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. This issue is fixed in version 1.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
InvoicePlane, a widely used self-hosted open-source platform for managing invoices, clients, and payments, was found to contain a critical security flaw related to the handling of state-changing operations via HTTP GET requests. Specifically, prior to version 1.7.2, the application exposed the Recurring::stop() functionality through a URL route that accepted only GET parameters without implementing any form of Cross-Site Request Forgery (CSRF) protection or additional authentication checks beyond standard session validation. This architectural decision violates fundamental web security principles regarding idempotency and state management, as HTTP GET requests are intended to be safe and side-effect-free operations that retrieve data rather than modify it. By allowing a simple hyperlink or image tag to trigger the termination of recurring invoices, the application created an avenue for unauthorized actions when users with administrative privileges were tricked into loading malicious content.
The technical flaw centers on the absence of CSRF token validation in the endpoint responsible for stopping recurring invoice schedules. In typical web applications, state-changing operations such as deleting records or modifying financial data should be restricted to POST, PUT, or DELETE methods and must require a unique, unpredictable anti-CSRF token tied to the user's session. Without this safeguard, an attacker can craft a malicious webpage containing a hidden request to /invoices/recurring/stop/{id}, where {id} is replaced with the identifier of any recurring invoice managed by the targeted administrator. When an authenticated admin visits this page, their browser automatically includes valid session cookies and credentials in the background request, causing InvoicePlane to process the command as if it were initiated legitimately by the user. This mechanism allows for fully automated exploitation without requiring complex social engineering beyond luring a victim to click a link or load a compromised site.
The operational impact of this vulnerability is significant due to its direct effect on financial operations and business continuity. By exploiting this flaw, an attacker can interrupt recurring billing cycles for multiple clients simultaneously by iterating through known invoice identifiers. This disruption leads directly to financial loss as payments are not collected according to the agreed schedules, potentially causing cash flow issues for small businesses or freelancers relying on automated income streams. Furthermore, the integrity of client relationships may be damaged if invoices appear unpaid due to system errors rather than actual non-payment by clients. The ability to target multiple identifiers amplifies the severity, turning a single point of failure into a widespread disruption tool that can affect numerous revenue-generating contracts in seconds.
This vulnerability is classified under CWE-352, which describes Cross-Site Request Forgery (CSRF), and aligns with MITRE ATT&CK technique T1498.002, Network Boundary Bridge: Remote Service Vulnerability, where an attacker leverages a trusted application to perform actions on behalf of the user. It also reflects CWE-601, URL Redirection to Untrusted Site, if exploited via phishing links that redirect users to malicious domains hosting the exploit payload. The root cause lies in the improper implementation of state-changing operations using safe HTTP methods and the lack of request origin verification or token-based validation mechanisms. Such oversights are common in older web frameworks but remain critical risks in modern application development where automated attacks can scale rapidly against unprotected endpoints.
To mitigate this risk, organizations running InvoicePlane must immediately upgrade to version 1.7.2 or later, which includes the necessary patches for CSRF protection on state-changing routes. For environments unable to update instantly due to compatibility constraints, temporary mitigations include restricting access to administrative functions through IP whitelisting or requiring multi-factor authentication that generates out-of-band tokens difficult to forge via simple HTTP requests. Additionally, implementing strict Content Security Policy headers can help prevent the execution of malicious scripts from untrusted origins, although this is a defense-in-depth measure rather than a primary fix. Regular security audits and adherence to OWASP guidelines for preventing CSRF in all state-modifying endpoints are essential practices to ensure long-term resilience against similar vulnerabilities.