Auth bypass in Invoiceplane
CVE-2026-85291
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Invoiceplane — versions < 1.7.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-85291?
- CVE-2026-85291 is a medium-severity vulnerability in Invoiceplane, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-25.
- How severe is CVE-2026-85291?
- Medium severity. CVSS v3 base score is 6.5 out of 10.