InvoicePlane up to 1.7.1 Session user_type authorization

Summaryinfo

A vulnerability identified as critical has been detected in InvoicePlane up to 1.7.1. Affected is an unknown function of the component Session. The manipulation of the argument user_type leads to authorization. This vulnerability is documented as CVE-2026-85292. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in InvoicePlane up to 1.7.1. This issue affects some unknown functionality of the component Session. The manipulation of the argument user_type with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-85292 since 09/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.7.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• InvoicePlane

Version

• 1.7.0
• 1.7.1

Website

• Product: https://github.com/InvoicePlane/InvoicePlane/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion