CVE-2026-85289

Deferred Deferred - Pending Action

CSRF Bypass Leading to Data Deletion in InvoicePlane

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85289

EUVD

EUVD-2026-87126

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a vulnerability where delete methods like Payments::delete(), Recurring::delete(), and User_clients::delete() do not validate CSRF tokens despite requiring POST requests. This allows attackers to trick authenticated administrators into submitting cross-origin forms that delete financial records and other data.

Detection Guidance

This vulnerability can be detected by checking the InvoicePlane version. If the version is below 1.7.2, the system is vulnerable. Review server logs for suspicious POST requests to delete endpoints like /payments/delete, /recurring/delete, or /user_clients/delete without CSRF tokens.

Impact Analysis

An attacker could exploit this to delete invoices, payment records, recurring transactions, or client data by tricking an administrator into visiting a malicious site. This could lead to financial loss, data corruption, or disruption of business operations.

Compliance Impact

This vulnerability could lead to unauthorized deletion of sensitive financial or client data, violating GDPR's data integrity principles or HIPAA's requirements for protecting health-related payment data. Organizations may face compliance violations and legal penalties if exploited.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later immediately. Ensure all sensitive data is backed up before upgrading. Review and restrict access to administrative functions. Monitor for unauthorized deletion attempts in server logs.

Hi! I’m here to help you understand CVE-2026-85289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70