CVE-2026-100392

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2

Description In the Users::form() function, the application fails to perform an object-level authorization check on the user id variable when it is set to 1. This allows a Secondary Administrator to change the Primary Administrator's user type to 2 (Guest / read-only), which removes the root account's privileges and locks the legitimate owner out of the instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.