CVE-2026-55561

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2-beta-1

Description Guest users can approve or reject quotes belonging to any client regardless of their assignment. In the Guest Quotes controller located at application/modules/guest/controllers/Quotes.php, the approve() and reject() methods call approve quote by id($quote id) and reject quote by id($quote id) without implementing the necessary client scoping. This allows a guest user to modify the status of another client's quote by providing sequential integer quote id values, which also triggers notification emails via email quote status(). Furthermore, the generate pdf() function calls mark viewed($quote id) before verifying the client scope, enabling guest users to mark quotes from other clients as viewed.

Recommendations Update to version 1.7.2-beta-1 or version 1.7.2.