Vulnerability
CVE-2026-88003
Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.
- Sharing
- PUBLIC-OSINT
- Confidence
- 100
- Source
- The CVE Program
- Updated
- 26/09/2026 04:32
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.
Aliases and classifications
CWE-863Incorrect Authorization
Minimised technical details
No raw data- cisa kev
- False
Provenance
Public references
- https://github.com/InvoicePlane/InvoicePlane/commit/904847f4e87b66fd6743cf9cc6f88b66c7fc3b81
https://github.com/InvoicePlane/InvoicePlane/commit/904847f4e87b66fd6743cf9cc6f88b66c7fc3b81 - https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 - https://github.com/InvoicePlane/InvoicePlane/commit/daa49ce3a50e0c93e01459b69c0d61bfc23d23eb
https://github.com/InvoicePlane/InvoicePlane/commit/daa49ce3a50e0c93e01459b69c0d61bfc23d23eb - https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8
EudorIA correlation
Intel catalogue
The vulnerability is also available in the EudorIA editorial catalogue.
Open EudorIA analysisPresence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.