# cve.now: Invoiceplane

The newest entries naming Invoiceplane as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55561](https://cve.now/CVE-2026-55561.md): InvoicePlane: Guest user IDOR in quote approval and rejection (CVSS 5.3)
- [CVE-2026-100392](https://cve.now/CVE-2026-100392.md): InvoicePlane: Primary Administrator Privilege Downgrade via \`Users::form()\` (Missing Object-Level Authorization) (CVSS 7.0)
- [CVE-2026-100371](https://cve.now/CVE-2026-100371.md): InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery (CVSS 8.7)
- [CVE-2026-88003](https://cve.now/CVE-2026-88003.md): InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade (CVSS 7.5)
- [CVE-2026-49850](https://cve.now/CVE-2026-49850.md): InvoicePlane: Missing CSRF Protection on State-Changing delete Actions (CVSS 7.5)
- [CVE-2026-50547](https://cve.now/CVE-2026-50547.md): InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier (CVSS 7.5)
- [CVE-2026-33639](https://cve.now/CVE-2026-33639.md): InvoicePlane permits DDL injection through tax\_rate\_decimal\_places (CVSS 7.2)
- [CVE-2026-39353](https://cve.now/CVE-2026-39353.md): InvoicePlane: Remote Code Execution via Writable Templates Directory (CVSS 9.1)
- [CVE-2026-85293](https://cve.now/CVE-2026-85293.md): InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms (CVSS 4.8)
- [CVE-2026-85291](https://cve.now/CVE-2026-85291.md): InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check (CVSS 6.5)
- [CVE-2026-85289](https://cve.now/CVE-2026-85289.md): InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints (CVSS 6.5)
- [CVE-2026-85292](https://cve.now/CVE-2026-85292.md): InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) (CVSS 4.8)
- [CVE-2026-85274](https://cve.now/CVE-2026-85274.md): InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection (CVSS 6.5)
- [CVE-2026-85290](https://cve.now/CVE-2026-85290.md): InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging (CVSS 5.3)
- [CVE-2026-39372](https://cve.now/CVE-2026-39372.md): InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments (CVSS 4.9)
- [CVE-2026-54790](https://cve.now/CVE-2026-54790.md): InvoicePlane: Second-order SQL injection through the unvalidated custom\_field\_table field in the Custom Fields module (CVSS 6.0)
- [CVE-2026-26281](https://cve.now/CVE-2026-26281.md): InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View (CVSS 4.4)
- [CVE-2026-26270](https://cve.now/CVE-2026-26270.md): InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting (CVSS 5.4)
- [CVE-2026-25596](https://cve.now/CVE-2026-25596.md): InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List (CVSS 4.8)
- [CVE-2026-25595](https://cve.now/CVE-2026-25595.md): InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard (CVSS 4.8)
- [CVE-2026-25594](https://cve.now/CVE-2026-25594.md): InvoicePlane has Stored XSS via Family Name in Product Form (CVSS 4.8)
- [CVE-2026-25548](https://cve.now/CVE-2026-25548.md): InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning (CVSS 9.1)
- [CVE-2026-24745](https://cve.now/CVE-2026-24745.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7)
- [CVE-2026-24744](https://cve.now/CVE-2026-24744.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7)
- [CVE-2026-24743](https://cve.now/CVE-2026-24743.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7)
- [CVE-2026-24746](https://cve.now/CVE-2026-24746.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7)
- [CVE-2026-23491](https://cve.now/CVE-2026-23491.md): InvoicePlane has Unauthenticated Path Traversal in Guest Controller (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/invoiceplane
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.