CVE-2026-85291

Deferred Deferred - Pending Action

Unauthorized Password Change in InvoicePlane

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85291

EUVD

EUVD-2026-87127

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a vulnerability in the Users::change_password() method. It allows an authenticated secondary administrator to change the password of another account, including the primary administrator, without knowing the current password. This is due to missing object-level authorization checks.

Detection Guidance

To detect this vulnerability, check if your InvoicePlane instance is running a version prior to 1.7.2. Use commands like 'grep -r "InvoicePlane" /var/www/html/' or check the version in the application's footer or settings. If the version is below 1.7.2, the system is vulnerable.

Impact Analysis

An attacker with secondary admin access could take over the primary administrator account. This would grant them full access to sensitive data, invoices, client information, and system privileges. The primary account could be locked out, disrupting legitimate operations.

Compliance Impact

This vulnerability could lead to unauthorized access to personal and financial data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Update InvoicePlane to version 1.7.2 or later to address the authorization bypass in the Users::change_password() method. Ensure only authorized users can change passwords and verify no unauthorized changes occurred.

Hi! I’m here to help you understand CVE-2026-85291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70