CVE-2026-85274

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description InvoicePlane exposes the Recurring::stop() function as a state-changing GET route that lacks Cross-Site Request Forgery (CSRF) token validation. CSRF is a type of attack that tricks a victim into submitting a malicious request. An authenticated administrator loading attacker-controlled content that requests the '/invoices/recurring/stop/{id}' endpoint can trigger the stopping of a selected recurring invoice. Attackers may target multiple identifiers to interrupt recurring billing, potentially leading to financial loss.

Recommendations Update to version 1.7.2.