CVE-2025-64012: InvoicePlane Auth Bypass Vulnerability

CVE-2025-64012 Overview

CVE-2025-64012 is an Insecure Direct Object Reference (IDOR) vulnerability in InvoicePlane, an open-source PHP invoicing application. The flaw exists in the invoices/view handler, which returns invoice data without verifying that the requesting user owns the invoice. An authenticated attacker can enumerate invoice identifiers to read invoice records belonging to other users. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and affects InvoicePlane version 1.6.1 at commit debb446c.

Critical Impact
Authenticated users can retrieve invoice records belonging to other tenants or customers by manipulating the invoice identifier parameter, leading to disclosure of billing data.

Affected Products

InvoicePlane 1.6.1
InvoicePlane commit debb446c
Deployments exposing the invoices/view handler to authenticated users

Discovery Timeline

2025-12-16 - CVE-2025-64012 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64012

Vulnerability Analysis

InvoicePlane exposes an invoices/view endpoint that renders invoice details based on an invoice identifier supplied in the request. The handler queries the invoice by identifier and returns the record, but it does not check whether the invoice belongs to the requesting user or client account. An authenticated attacker who can reach the endpoint can iterate over sequential invoice IDs and receive data for invoices they should not see.

Related changes in the referenced commit also touch the guest attachment download URLs in application/views/invoice_templates/public/InvoicePlane_Web.php and application/views/quote_templates/public/InvoicePlane_Web.php, restoring the guest/get/attachment/ route used for public download links.

Root Cause

The root cause is missing ownership validation in the invoices/view controller path. The application trusts the invoice identifier supplied by the client and performs no authorization check binding the record to the current session. This pattern is a textbook IDOR: the object reference is user-controlled, and no server-side policy gates access.

Attack Vector

Exploitation requires low-privileged authenticated access over the network. An attacker requests invoice records by identifier, incrementing or fuzzing the ID parameter to enumerate invoices belonging to other users or customers. No user interaction is required, and confidentiality of invoice contents is impacted while integrity and availability are not.

php

// Patch context from application/views/invoice_templates/public/InvoicePlane_Web.php
<tr class="attachments">
    <td><?php echo $attachment['name']; ?></td>
    <td>
-       <a href="<?php echo site_url('guest/get_file/attachment/' . $attachment['fullname']); ?>"
+       <a href="<?php echo site_url('guest/get/attachment/' . $attachment['fullname']); ?>"
           class="btn btn-primary btn-sm">
            <i class="fa fa-download"></i> <?php _trans('download') ?>
        </a>

Source: InvoicePlane commit debb446c

A proof-of-concept walkthrough is published as a GitHub Gist by tarekramm.

Detection Methods for CVE-2025-64012

Indicators of Compromise

Repeated authenticated requests to /invoices/view/<id> with sequential or fuzzed identifier values from a single session.
Access log entries showing a single account retrieving invoice records associated with multiple unrelated client IDs.
Anomalous spikes in HTTP 200 responses from the invoices/view handler over a short timeframe.

Detection Strategies

Correlate web server access logs with application session data to identify accounts viewing invoices outside their assigned client scope.
Deploy a Web Application Firewall (WAF) rule that flags high-rate enumeration of numeric identifiers on the invoices/view route.
Add server-side audit logging that records the requesting user ID alongside the invoice ID returned, then alert on mismatches.

Monitoring Recommendations

Baseline normal invoice-view volume per user and alert on deviations that suggest scraping behavior.
Monitor for authenticated sessions issuing many requests within short intervals to identifier-driven endpoints.
Retain HTTP access logs long enough to support retrospective hunting for enumeration patterns.

How to Mitigate CVE-2025-64012

Immediate Actions Required

Apply the fix from InvoicePlane commit debb446c or upgrade to a release that incorporates it.
Restrict access to the InvoicePlane administrative interface to trusted networks or VPN users until patched.
Audit recent access logs for signs of invoice enumeration and notify affected customers if disclosure is confirmed.

Patch Information

The upstream fix is published in the InvoicePlane repository at commit debb446ceaa84efc136987fc1e21b268f34e47b0. The change adjusts the affected view templates and related handler behavior. Administrators should track the InvoicePlane project for a tagged release that includes ownership validation on the invoices/view handler and deploy it across all instances.

Workarounds

Place InvoicePlane behind an authenticating reverse proxy that limits access to known internal users while the patch is validated.
Add a WAF rule that requires the requesting user's session context to match the invoice ID being requested, blocking unrelated access.
Disable or restrict the invoices/view route for lower-privilege accounts if the deployment model allows.

bash

# Example nginx rate-limit to slow ID enumeration on the invoices/view route
limit_req_zone $binary_remote_addr zone=ip_view:10m rate=10r/m;

location ~ ^/invoices/view/ {
    limit_req zone=ip_view burst=5 nodelay;
    proxy_pass http://invoiceplane_backend;
}