CVE-2026-85292: InvoicePlane Authentication Bypass Vulnerability

CVE-2026-85292 Overview

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Versions prior to 1.7.2 contain an authorization bypass vulnerability in the User_Controller class. The controller compares the session user_type value with the required role using PHP's loose inequality operator (!=). Under non-standard session backends that return unexpected scalar types, PHP type juggling can cause values that are not strictly the required role to pass the authorization check. This flaw maps to [CWE-697: Incorrect Comparison] and is fixed in InvoicePlane 1.7.2.

Critical Impact

Attackers can bypass role-based authorization in InvoicePlane under affected session configurations, potentially accessing administrative functionality without proper privileges.

Affected Products

• InvoicePlane versions prior to 1.7.2
• Deployments using non-standard session backends that return unexpected scalar types
• Self-hosted InvoicePlane installations with custom session storage drivers

Discovery Timeline

• 2026-09-25 - CVE-2026-85292 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-85292

Vulnerability Analysis

The vulnerability resides in application/core/User_Controller.php. During controller construction, InvoicePlane validates the authenticated user's role by comparing a session value against a required role string. The comparison uses PHP's loose inequality operator, which triggers type juggling when operands have different types.

Under PHP's loose comparison rules, values such as integer 0, boolean false, or null can compare as equal to certain non-empty strings depending on the PHP version and operand types. When a session backend stores or returns the user_type value as a non-string scalar, the authorization check can incorrectly succeed for a user who does not hold the required role.

Root Cause

The root cause is use of loose comparison (!=) instead of strict comparison (!==) when enforcing session-based role checks. The code also failed to cast the required role to a string before comparison, allowing type coercion to govern the authorization outcome.

Attack Vector

Exploitation requires a deployment configured with a non-standard session backend that returns user_type as a type other than the expected string. An attacker holding a lower-privilege session can access controllers protected by a higher required role when the stored session type triggers favorable juggling. The attack is remote and requires no user interaction, though attack complexity is high because it depends on the deployment's session storage behavior.

     {
         parent::__construct();
 
-        if ($this->session->userdata($required_key) != $required_val) {
+        if ($this->session->userdata($required_key) !== (string) $required_val) {
             session_destroy();
             redirect('sessions/login');
         }

Source: GitHub Commit efa9f57 — The patch replaces loose inequality (!=) with strict inequality (!==) and explicitly casts $required_val to a string, eliminating type juggling in the authorization check.

Detection Methods for CVE-2026-85292

Indicators of Compromise

• Access to administrative routes or controllers by sessions associated with non-admin accounts
• Unexpected privileged actions in InvoicePlane audit logs originating from standard user accounts
• Session user_type values stored as non-string scalar types in the configured session backend

Detection Strategies

• Audit the InvoicePlane installation version and confirm whether it is below 1.7.2
• Review session driver configuration in application/config/config.php for non-default session handlers
• Inspect web server access logs for requests to admin-only endpoints from sessions that previously only accessed user-level routes

Monitoring Recommendations

• Enable application-level logging for every role check failure and successful privileged action
• Monitor outbound actions such as invoice modification, client data export, and user creation for anomalous actors
• Correlate authentication events with subsequent privileged controller access to identify role-based anomalies

How to Mitigate CVE-2026-85292

Immediate Actions Required

• Upgrade InvoicePlane to version 1.7.2 or later, which applies strict comparison in User_Controller
• Audit all active user sessions and force reauthentication after upgrade
• Review user accounts for unauthorized privilege changes or administrative activity

Patch Information

The fix is included in InvoicePlane Release v1.7.2 and introduced via Pull Request #1640. The security advisory is published as GHSA-346c-gqqq-mrm2. The code change in commit efa9f57 replaces != with !== and casts the required role to (string) before comparison.

Workarounds

• Revert to the default CodeIgniter session driver that stores and returns user_type as a string
• Restrict network access to the InvoicePlane application to trusted administrators until the patch is applied
• Apply the single-line comparison fix from the upstream commit as a hotpatch if an immediate upgrade is not feasible

# Verify installed version and upgrade
cd /var/www/invoiceplane
grep -i "version" VERSION
# Download and deploy v1.7.2
wget https://github.com/InvoicePlane/InvoicePlane/releases/download/v1.7.2/v1.7.2.zip
unzip v1.7.2.zip -d /var/www/invoiceplane-new
# Preserve existing ipconfig.php and uploads directory before cutover