CVE-2026-85274

Deferred Deferred - Pending Action

Recurring Invoice Stop via CSRF in InvoicePlane

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85274

EUVD

EUVD-2026-87124

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a vulnerability where the Recurring::stop() function is accessible via a GET request without CSRF token validation. This allows an attacker to trick an authenticated administrator into loading a malicious link or page that triggers the stop action for recurring invoices by accessing /invoices/recurring/stop/{id}. The attacker can target multiple invoice IDs to disrupt recurring billing cycles.

Detection Guidance

Check InvoicePlane version for anything below 1.7.2. Review web server access logs for GET requests to /invoices/recurring/stop/{id} from authenticated administrators. Look for unusual patterns of recurring invoice stops.

Impact Analysis

This vulnerability can lead to financial loss if an attacker stops recurring invoices, disrupting billing cycles for clients. It requires an authenticated administrator to unknowingly trigger the malicious request, but once exploited, it can cause interruptions in revenue streams and damage business operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as described. The issue involves a CSRF vulnerability in InvoicePlane that could lead to unauthorized actions like stopping recurring invoices, potentially causing financial loss. Compliance impacts would depend on how the affected data or processes relate to regulated information, but the CVE itself does not specify such connections.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later immediately. Implement CSRF token validation for state-changing GET routes. Monitor for unauthorized recurring invoice stops and review financial transactions.

Hi! I’m here to help you understand CVE-2026-85274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70