CVE-2026-100392— InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
Quick assessment
Affected
InvoicePlane InvoicePlane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InvoicePlane 是一款自托管的开源应用，用于管理发票、客户和支付信息。在 1.7.2 版本中， 方法未对 执行对象级授权检查。一名次要管理员（ 且 ）可以将主要管理员（Primary Administrator）的 修改为 2（Guest/只读），从而摧毁超级管理员账户的特权，并导致系统合法所有者被锁定在实例之外。截至发布时，尚无公开的修复补丁。
Possible ATT&CK Techniques 3 AI
T1136 · Create Account T1078.004 · Cloud Accounts T1136.003 · Cloud Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100392
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
Source: CVE Program / CVE List V5
Vulnerability Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| InvoicePlane | InvoicePlane | = 1.7.2 | - |
|
II. Public POCs for CVE-2026-100392
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100392
请登录查看更多情报信息。
Other References for CVE-2026-100392 (1)
IV. Related Vulnerabilities
Same product: InvoicePlane
-
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users: -
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_
Same vendor: InvoicePlane
-
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users: -
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_
Same weakness: CWE-863
-
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users: -
CVE-2026-97335
Incorrect authorization in LXD storage volume API allows rea -
CVE-2026-19759
Incorrect Authorization in Application Integration allows In -
CVE-2026-82378
Apache Roller: OAuth authorization endpoint trusts request-s -
CVE-2026-101006
Frappe HR Permission Validation __init__.py get_attendance_r
V. Comments for CVE-2026-100392
No comments yet