Authorization Bypass in InvoicePlane Application

CVE-2026-85292

What is CVE-2026-85292?

InvoicePlane is a self-hosted open source application designed for managing invoices, clients, and payments. A vulnerability was identified in versions prior to 1.7.2 where the User_Controller performed authorization checks using PHP's loose inequality operator. This approach can lead to type juggling issues, especially under non-standard session backends, resulting in unauthorized users potentially bypassing authentication and authorization checks. Users are strongly advised to upgrade to version 1.7.2 or later to mitigate this risk.

References