{"id":"CVE-2026-88003","title":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments","summary":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_ty…","severity":"high","cvss":7.5,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-863"],"vendor":"InvoicePlane","product":"InvoicePlane","affected":["InvoicePlane < 1.7.2"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T22:18:49.580","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88003","references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/904847f4e87b66fd6743cf9cc6f88b66c7fc3b81","label":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/daa49ce3a50e0c93e01459b69c0d61bfc23d23eb","label":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","label":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-09-25T22:20:31.564Z","slug":"CVE-2026-88003","body":"## Overview\n\nInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}