CVE-2026-33639

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The resulting schema corruption can permanently modify financial data structures and make the application unavailable. This vulnerability is fixed in 1.7.2.

• CWE-89

• https://github.com/InvoicePlane/InvoicePlane/commit/8fe41750d7c6fd039ac7353e5311bf4c140c3436
• https://github.com/InvoicePlane/InvoicePlane/commit/efec2d28d574ca616f218d758bd5adaa9a60b3a0
• https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20
• https://github.com/InvoicePlane/InvoicePlane/pull/1481
• https://github.com/InvoicePlane/InvoicePlane/pull/1488
• https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33633Kitty is a cross-platform GPU based terminal. Versions 0.46.…8.8
• CVE-2026-33634Trivy is a security scanner. On March 19, 2026, a threat act…8.8
• CVE-2026-33635iCalendar is a Ruby library for dealing with iCalendar files…4.3
• CVE-2026-33636LIBPNG is a reference library for use in applications that r…7.6
• CVE-2026-33637Faraday is an HTTP client library abstraction layer that pro…6.5
• CVE-2026-33638Ech0 is an open-source, self-hosted publishing platform for …5.3
• CVE-2026-33640Outline is a service that allows for collaborative documenta…9.8
• CVE-2026-33641Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-33642Kitty is a cross-platform GPU based terminal. In versions 0.…9.8
• CVE-2026-33643SQL Injection vulnerability in SchemaHero 0.23.0 via the col…7.4
• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1