---
id: CVE-2026-88003
title: >-
  InvoicePlane is a self-hosted open source application for managing invoices,
  clients, and payments
summary: >-
  InvoicePlane is a self-hosted open source application for managing invoices,
  clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke
  administrative privileges after a role downgrade because Admin_Controller
  trusts the user_ty…
severity: high
cvss: 7.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-863
vendor: InvoicePlane
product: InvoicePlane
affected:
  - InvoicePlane < 1.7.2
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T22:18:49.580'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88003'
references:
  - url: >-
      https://github.com/InvoicePlane/InvoicePlane/commit/904847f4e87b66fd6743cf9cc6f88b66c7fc3b81
    label: security-advisories@github.com
  - url: >-
      https://github.com/InvoicePlane/InvoicePlane/commit/daa49ce3a50e0c93e01459b69c0d61bfc23d23eb
    label: security-advisories@github.com
  - url: 'https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-25T22:20:31.564Z'
---

## Overview

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.