CVE-2026-55561

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve() and reject() methods in the Guest Quotes controller, application/modules/guest/controllers/Quotes.php, call approve quote by id($quote id) and reject quote by id($quote id) directly without the where in('ip quotes.client id', $this->user clients) scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer quote id values, and email quote status() also sends notification emails. Additionally, generate pdf() calls mark viewed($quote id) before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.