CVE-2026-85291: InvoicePlane Auth Bypass Vulnerability

CVE-2026-85291 Overview

InvoicePlane is a self-hosted open-source application for managing invoices, clients, and payments. Versions prior to 1.7.2 contain an Insecure Direct Object Reference [CWE-639] in the Users::change_password() controller method. The method accepts a user_id from the URL and updates the targeted account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current one. This issue is fixed in version 1.7.2.

Critical Impact
An authenticated secondary administrator can take over the primary administrator account, gaining full access to invoices, client records, payment data, and application privileges.

Affected Products

InvoicePlane versions prior to 1.7.2
Self-hosted InvoicePlane deployments exposing authenticated admin interfaces
InvoicePlane application/modules/users/ controller and views

Discovery Timeline

2026-09-25 - CVE-2026-85291 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-85291

Vulnerability Analysis

The flaw resides in application/modules/users/controllers/Users.php, in the change_password(string $user_id) method. The controller trusts the user_id path parameter and updates the password for the referenced account. It does not verify that the requesting session owns the account being modified. It also does not require the current password as a confirmation step for the target account.

As a result, any authenticated user with access to the user management flow can issue a password change against an arbitrary user_id. When the target is the primary administrator, the attacker gains administrative control. This is a textbook Insecure Direct Object Reference and maps to [CWE-639] Authorization Bypass Through User-Controlled Key.

Root Cause

The controller performs an authentication check but omits an authorization check that binds the operation to the session's own user_id. The absence of this object-level check allows horizontal and vertical privilege escalation when the target account carries higher privileges than the attacker.

Attack Vector

Exploitation requires authenticated access to the application and reachability of the users module. The attacker submits a password change request against the primary administrator's user_id via the users/change_password/{id} route. After the request completes, the attacker logs in as the primary administrator with the new password.

php

// Security patch in application/modules/users/controllers/Users.php
// Restrict Users::change_password() to the requester's own account (CWE-639)
     */
    public function change_password(string $user_id)
    {
+       if ((string) $user_id !== (string) $this->session->userdata('user_id')) {
+           show_error(trans('access_denied'), 403);
+
+           return;
+       }
+
        if ($this->input->post('btn_cancel')) {
            redirect('users');
        }
// Source: https://github.com/InvoicePlane/InvoicePlane/commit/7af2cdd1138ab5e9cd4d95333180e617aecc86cf

php

// Security patch in application/modules/users/views/form.php
// Only expose the change-password link for the requester's own account
                                <input type="password" name="user_passwordv" id="user_passwordv" class="form-control" required>
                            </div>
<?php
-} else { // Edit user
+} elseif ($this->session->userdata('user_id') == $id) { // Edit own account
    ?>
                            <div class="form-group">
                                <a href="<?php echo site_url('users/change_password/' . $id); ?>"
// Source: https://github.com/InvoicePlane/InvoicePlane/commit/7af2cdd1138ab5e9cd4d95333180e617aecc86cf

Detection Methods for CVE-2026-85291

Indicators of Compromise

HTTP POST requests to users/change_password/{id} where {id} does not match the authenticated session's user_id.
Successful logins for the primary administrator from unexpected IP addresses or user agents shortly after a password change event.
Unexpected entries in the ip_users table showing a password field update for the primary admin account.

Detection Strategies

Review web server access logs for requests to the users/change_password/ route and correlate the trailing user_id with the authenticated session identifier.
Alert on password change operations targeting administrator accounts initiated by non-matching session users.
Audit application logs and database triggers for password hash updates on privileged accounts outside of expected maintenance windows.

Monitoring Recommendations

Enable verbose request logging for the InvoicePlane users module and ship logs to a centralized SIEM for correlation.
Monitor administrator login patterns, including source IP, geolocation, and session cookie reuse, following any password change event.
Track account-level changes against a baseline of expected administrative activity and raise alerts on cross-account password modifications.

How to Mitigate CVE-2026-85291

Immediate Actions Required

Upgrade InvoicePlane to version 1.7.2 or later, which enforces the object-level authorization check in Users::change_password().
Review the user table and remove or disable any secondary administrator accounts that are not strictly required.
Reset passwords for all administrator accounts and invalidate active sessions after upgrading.

Patch Information

The fix is included in InvoicePlane Release v1.7.2. The code change is documented in the InvoicePlane commit 7af2cdd and in GitHub Security Advisory GHSA-x38q-xhjj-jr8w. The patch rejects change_password requests when the URL user_id does not match session->userdata('user_id') and hides the change-password link in form.php for accounts other than the requester's own.

Workarounds

Restrict the number of administrator-level accounts and limit account creation to trusted operators until the upgrade is applied.
Place the InvoicePlane admin interface behind a VPN or IP allow-list to reduce the authenticated attack surface.
Apply a reverse proxy rule that blocks POST requests to users/change_password/{id} unless the authenticated session cookie maps to the same {id}.

bash

# Example nginx rule to log and inspect change_password requests for review
location ~ ^/index\.php/users/change_password/(\d+)$ {
    access_log /var/log/nginx/invoiceplane_pwchange.log;
    # Forward to PHP-FPM as usual
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}