CVE-2026-100371

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the Users::change password() function, the Users::form() function lacks equivalent object-level authorization checks when editing the primary administrator's account. Because the user email variable is not included in PROTECTED FIELDS, a secondary administrator can modify the primary administrator's email address. This allows the attacker to use the public password-recovery flow, which identifies accounts by user email, to receive a reset token and gain full control of the primary administrator account via the users/change password/{id} endpoint.

Recommendations Update InvoicePlane to version 1.7.2 or later.