CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.

• CWE-863

• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-4fxw-x7wr-x6qc

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100387pgPointcloud through 1.2.5 contains a heap out-of-bounds rea…8.1
• CVE-2026-100388RustDesk versions before 1.5.0 fail to properly validate fil…5.4
• CVE-2026-100389GestSup versions before 3.2.61 contain a remote code executi…8.1
• CVE-2026-10039The Frontend Admin by DynamiApps plugin for WordPress is vul…4.9
• CVE-2026-100390Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse I…7.4
• CVE-2026-100391MediaFlow Proxy through 2.4.9 contains a server-side request…8.2
• CVE-2026-1004The Essential Addons for Elementor plugin for WordPress is v…5.3
• CVE-2026-10041The WCFM – Frontend Manager for WooCommerce plugin for WordP…4.3
• CVE-2026-100417RustDesk before 1.5.0 on Windows fails to enforce the one-wa…3.1
• CVE-2026-100418Flame through 2.4.0 contains an information exposure vulnera…5.3
• CVE-2026-100419gitoxide gix-fs before 0.23.0 contains a path validation byp…7
• CVE-2026-10042manga-image-translator contains a remote code execution vuln…9.8