CVE-2026-49850

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description InvoicePlane exposes the delete() and delete invoice tax() functions within the Invoices module as state-changing routes that do not require a POST request or CSRF (Cross-Site Request Forgery) token validation. CSRF is a type of attack that tricks a victim into submitting a malicious request. Consequently, if an authenticated administrator loads attacker-controlled content that requests these routes, the application may delete an invoice or invoice tax record, leading to the unintended removal of financial data.

Recommendations Update to version 1.7.2.