CVE-2026-85292 in InvoicePlane
Summary
by MITRE • 09/25/2026
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
InvoicePlane serves as a self-hosted open-source solution for managing invoices, clients, and payments, relying on robust access control mechanisms to ensure that users interact only with resources appropriate to their assigned roles. The vulnerability identified within versions prior to 1.7.2 resides in the User_Controller component, which is responsible for enforcing role-based access controls during user interactions. Specifically, the application utilizes PHP's loose inequality operator when comparing the session-stored user_type value against the required role for a given action. This implementation choice introduces a critical logic flaw rooted in how PHP handles type comparison under specific conditions, leading to potential authorization bypasses that compromise the integrity of the access control system.
The technical core of this vulnerability lies in the behavior of PHP's loose comparison operators when dealing with non-standard session backends. In standard configurations, user types are typically stored as strings or integers, and comparisons behave predictably. However, under certain session storage mechanisms that return unexpected scalar types, such as objects converted to strings or specific numeric representations, type juggling can occur. When the application uses a loose comparison operator, PHP attempts to coerce operands to compatible types before performing the check. This coercion process can result in values that are not strictly equivalent to the required role being evaluated as equal or unequal depending on the context, effectively allowing an attacker with lower privileges to bypass authorization checks intended for higher-privilege roles.
This flaw directly impacts the confidentiality and integrity of the application by permitting unauthorized access to administrative functions or sensitive data. An authenticated user could exploit this type juggling weakness to escalate their privileges without possessing valid credentials for a higher role, effectively achieving an authentication or authorization bypass. The operational impact is severe because it undermines the fundamental security model of the application, allowing malicious actors to perform actions such as modifying invoices, accessing client financial details, or altering system configurations in ways that should be restricted by policy. This type of vulnerability aligns with CWE-285, which describes Improper Authorization, and can also be mapped to MITRE ATT&CK techniques related to privilege escalation, where an attacker leverages a flaw in access control logic to gain elevated permissions within the environment.
The resolution for this issue was implemented in version 1.7.2 of InvoicePlane by replacing the loose comparison operators with strict equality checks or ensuring that type casting is handled explicitly and securely before comparison. This change ensures that only values strictly matching the expected role are granted access, eliminating the ambiguity introduced by PHP's automatic type coercion. To mitigate this risk, administrators must upgrade to version 1.7.2 or later immediately if they have not already done so. Additionally, organizations should review their session backend configurations to ensure compatibility with strict typing practices and consider implementing additional monitoring for unusual authorization patterns that might indicate exploitation attempts against similar legacy systems still in use.