CVE-2026-88003

Received Received - Intake

Privilege Escalation in InvoicePlane Due to Session Misconfiguration

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-88003

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	1.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a privilege escalation flaw where downgrading an admin user does not revoke their privileges. The system trusts a stored session value for user_type instead of rechecking the database, allowing downgraded users to regain admin rights through session manipulation.

Detection Guidance

To detect this vulnerability, check if InvoicePlane versions prior to 1.7.2 are installed. Verify if administrative privileges were downgraded but not properly revoked by reviewing session persistence and user role changes in the database. Look for unauthorized privilege escalation attempts by monitoring user_type modifications in the ip_users table.

Impact Analysis

An attacker with access to a downgraded admin account could escalate privileges back to administrator, gaining control over invoicing, client data, and payment systems. This could lead to unauthorized transactions, data theft, or system compromise.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection. Unauthorized privilege escalation risks exposing sensitive client or financial data, potentially leading to regulatory penalties under GDPR or HIPAA.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later to address the privilege escalation issue. Review active sessions of downgraded users and invalidate any suspicious sessions. Monitor user_type changes in the database to detect unauthorized privilege modifications.

Hi! I’m here to help you understand CVE-2026-88003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70