CVE-2026-85292

Deferred Deferred - Pending Action

Authorization Bypass in InvoicePlane via Type Juggling

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85292

EUVD

EUVD-2026-87125

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-697	The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has an authorization bypass vulnerability due to using PHP's loose inequality operator in User_Controller. This allows type juggling to incorrectly validate user roles when session backends return unexpected scalar types, letting unauthorized users bypass checks.

Detection Guidance

This vulnerability is specific to InvoicePlane versions prior to 1.7.2 and involves a type juggling issue in session-based authorization checks. To detect it, verify your InvoicePlane version by checking the application files or database for version 1.7.2 or later. If using a non-standard session backend, review session handling logic for unexpected scalar types that could allow bypass.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive invoice, client, or payment data if the system uses a non-standard session backend. This may lead to data theft, fraud, or further system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or financial data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update InvoicePlane to version 1.7.2 or later to address the authorization bypass issue caused by type juggling in session handling.

Hi! I’m here to help you understand CVE-2026-85292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70