CVE-2026-49850

Deferred Deferred - Pending Action

CSRF Vulnerability in InvoicePlane Leading to Invoice Deletion

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-49850

EUVD

EUVD-2026-87133

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a vulnerability where authenticated administrators can unintentionally delete invoices or invoice tax records due to missing CSRF token validation and POST requirement on state-changing routes. Attackers can exploit this by tricking administrators into loading malicious content that triggers these routes.

Detection Guidance

To detect this vulnerability, check for unauthorized invoice deletions or tax record removals in your InvoicePlane logs. Look for GET requests to routes like /invoices/delete or /invoices/delete_invoice_tax without POST or CSRF token validation. Monitor network traffic for suspicious cross-origin requests targeting these endpoints.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized deletion of financial data such as invoices or tax records. This may cause data loss, disrupt billing operations, and potentially result in financial discrepancies or compliance violations for affected organizations.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data deletion, which may violate integrity and accountability requirements. Organizations may face penalties or legal consequences if sensitive financial data is compromised or lost due to this issue.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later to address the vulnerability. Ensure all instances are updated to prevent unauthorized invoice or tax record deletions.

Hi! I’m here to help you understand CVE-2026-49850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70