CVE-2026-100392: InvoicePlane Privilege Escalation Flaw

CVE-2026-100392 Overview

InvoicePlane 1.7.2 contains a broken access control flaw in the Users::form() function. The application performs no object-level authorization check when a user modifies the account with user_id = 1, which is the Primary Administrator. A Secondary Administrator (user_type = 1) can send a crafted request that rewrites the Primary Administrator's user_type to 2 (Guest / read-only). This action destroys the root account's privileges and locks the legitimate owner out of the instance. The weakness is tracked under [CWE-863: Incorrect Authorization]. At the time of publication, no patch is available from the InvoicePlane project.

Critical Impact
Any authenticated Secondary Administrator can permanently demote the Primary Administrator and seize exclusive control of the InvoicePlane instance.

Affected Products

InvoicePlane 1.7.2
Self-hosted InvoicePlane deployments running the vulnerable Users controller
Instances with more than one administrator account provisioned

Discovery Timeline

2026-09-28 - CVE-2026-100392 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100392

Vulnerability Analysis

InvoicePlane is a self-hosted PHP application for managing invoices, clients, and payments. The Users::form() controller processes edits to any user record referenced by the user_id request parameter. The controller validates that the caller is authenticated with administrator privileges but does not validate whether the target record belongs to a protected principal.

The Primary Administrator is uniquely identified by user_id = 1 and serves as the root account. Because the controller applies no object-level check against this identifier, a Secondary Administrator can submit a form post that targets user_id = 1 and change the user_type field. Setting user_type = 2 demotes the Primary Administrator to a Guest role with read-only access.

The consequence is a permanent takeover of the administrative tier. The legitimate owner loses the ability to manage users, invoices, or configuration, while the attacker retains full administrator rights. Recovery requires direct database access to restore the user_type column.

Root Cause

The root cause is a missing authorization check tied to the sensitive user_id = 1 record. The application enforces role-based access at the controller entry point but does not enforce object-level or attribute-level authorization on the write path. The user_type attribute of the root account is treated as a normal editable field rather than a protected value.

Attack Vector

Exploitation requires an authenticated Secondary Administrator session. The attacker issues a POST request to the user edit endpoint with user_id = 1 and user_type = 2 in the body. No user interaction from the victim is required. The vulnerability is exploitable over the network wherever the InvoicePlane web interface is reachable. See the GitHub Security Advisory GHSA-4fxw-x7wr-x6qc for advisory details.

Detection Methods for CVE-2026-100392

Indicators of Compromise

Unexpected changes to the user_type column of user_id = 1 in the InvoicePlane database.
POST requests to the user edit route where the request body contains user_id=1 and originates from an account other than the Primary Administrator.
Sudden loss of administrative access reported by the Primary Administrator.

Detection Strategies

Query the InvoicePlane user table and alert when user_id = 1 has a user_type value other than 1.
Enable web server access logging and inspect POST requests targeting the users/form endpoint for parameter tampering.
Correlate application audit records with authenticated session identifiers to attribute changes to specific administrator accounts.

Monitoring Recommendations

Baseline the normal set of administrators and alert on any modification to privileged user records.
Forward web application logs to a centralized logging platform and retain them for post-incident review.
Schedule periodic integrity checks that verify the Primary Administrator retains user_type = 1.

How to Mitigate CVE-2026-100392

Immediate Actions Required

Reduce the number of Secondary Administrator accounts to the minimum required for operations.
Restrict network access to the InvoicePlane administrative interface using firewall rules, VPN, or IP allow-listing.
Take a verified backup of the InvoicePlane database so that a demotion event can be reversed quickly.
Monitor the InvoicePlane security advisories for the release of an official patch.

Patch Information

At the time of publication, the InvoicePlane project has not released a patch for CVE-2026-100392. Administrators should track the vendor advisory and apply the fix as soon as it becomes available. Any interim fix should add an object-level authorization check that prevents non-root accounts from modifying user_id = 1.

Workarounds

Remove or disable all Secondary Administrator accounts until a patch is available, leaving only the Primary Administrator with elevated privileges.
Apply a local code modification to Users::form() that rejects write operations targeting user_id = 1 when the acting session is not the Primary Administrator.
Enforce database-level constraints or triggers that reject updates changing the user_type of the root account.

bash

# Example database integrity check for InvoicePlane
mysql -u root -p invoiceplane -e \
  "SELECT user_id, user_type FROM ip_users WHERE user_id = 1 AND user_type <> 1;"