CVE-2026-100371 Missing authorization in InvoicePlane
A secondary administrator can take over the primary administrator account by modifying their email address due to missing authorization checks in the user form.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100371?
CVE-2026-100371 is a high-severity missing authorization vulnerability in InvoicePlane, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was added to address a previous authorization flaw that allowed a secondary administrator (user_type=1, user_id != 1) to directly change the password of the primary administrator (user_id=1) through users/change_password/{id}. That remediation, however, protects only the direct password-change operation. It does not protect the identity attribute that password recovery actually trusts: user_email. Users::form() applies no equivalent object-level authorization check when editing the primary administrator's account, and user_email is not included in PROTECTED_FIELDS. A secondary administrator can therefore rewrite the primary administrator's email address, then drive the public password-recovery flow — which resolves the account by user_email — to receive the reset token and take over user_id=1. The result is an alternate attack path that achieves the same impact PR #1638 was intended to prevent: cross-administrator full account takeover of the primary administrator. This issue has been patched via commit 8616fa4.
Weakness: CWE-863
Which versions are affected by CVE-2026-100371?
How do I fix CVE-2026-100371?
No fix has been published for CVE-2026-100371 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100371 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100371 exists.
Sources
Also known as GHSA-77hm-22wp-96wp.