6.5

CVE-2026-85289

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerInvoicePlane
≫
Produkt InvoicePlane
Version < 1.7.2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9372-vj68-hmc3
https://github.com/InvoicePlane/InvoicePlane/pull/1637
https://github.com/InvoicePlane/InvoicePlane/commit/215b8c1acca7560d00b7e463fb1c6fe98235ab95