Improper Input Validation in InvoicePlane Affects Billing Processes

CVE-2026-85274

What is CVE-2026-85274?

InvoicePlane, a self-hosted application for managing invoices, clients, and payments, suffers from a vulnerability that allows an authenticated administrator to unintentionally stop recurring invoices. This occurs when the Recurring::stop() function is exposed as a state-changing GET route lacking proper CSRF token validation. If an attacker can send specially crafted requests to the /invoices/recurring/stop/{id} endpoint, they can cause numerous recurring invoices to be halted, leading to potential financial losses for organizations. This vulnerability was addressed in version 1.7.2 of InvoicePlane.

References