Guest user IDOR in InvoicePlane quote approval and rejection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
InvoicePlane before 1.7.2-beta-1 lets guest users approve or reject quotes belonging to any client, including clients they are not assigned to. The approve and reject methods in the Guest Quotes controller skip the client scoping that sibling methods apply, so a guest user assigned to one client can change another client's quote status by supplying sequential integer quote_id values. The same flaw lets a guest user mark another client's quote as viewed, which relates to an authorization bypass through a user-controlled key (CWE-639). An attacker needs a guest account with low privileges, and the CVSS 4.0 vector rates the impact as low integrity loss.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| InvoicePlane | InvoicePlane | before 1.7.2-beta-1 | 1.7.2-beta-1 | Patch available | CNA |
- InvoicePlane VendorInvoicePlane Affected before 1.7.2-beta-1 Fixed in 1.7.2-beta-1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:* | — | — | InvoicePlane |
- cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:* Versions — — ·InvoicePlane
Remediation
Upgrade InvoicePlane to 1.7.2-beta-1 or the stable 1.7.2 release, which fix this flaw. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA InvoicePlane (InvoicePlane) Fixed in 1.7.2-beta-1
Timeline
- 2026-10-28 Threatist record created from CVE-2026-55561
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: LOW → MEDIUM
References
Other 7
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-6xj3-274m-4mvg
- https://github.com/InvoicePlane/InvoicePlane/pull/1413
- https://github.com/InvoicePlane/InvoicePlane/pull/1471
- https://github.com/InvoicePlane/InvoicePlane/commit/424dc44eb54030b93176bb08cba07ba12d7ae451
- https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2-beta-1
More InvoicePlane vulnerabilities
- TI-2026-18924 InvoicePlane has Unauthenticated Path Traversal in Guest Controller CVSS 4.0CRITICAL 9.3
- TI-2026-64649 Incorrect authorization in InvoicePlane CVSS 4.0HIGH 8.7
- TI-2025-41126 File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to… CVSS 3.1CRITICAL 9.9
- TI-2026-28341 InvoicePlane: Remote Code Execution via Writable Templates Directory CVSS 3.1CRITICAL 9.1
- TI-2026-60029 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade CVSS 4.0HIGH 7.5
- TI-2026-26020 InvoicePlane permits DDL injection through tax_rate_decimal_places CVSS 3.1HIGH 7.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences