CyberRota Analysis
AI-GeneratedThe vulnerability in InvoicePlane version 1.7.2 allows a Secondary Administrator to manipulate the user privileges of the Primary Administrator by exploiting a lack of object-level authorization checks. This can lead to the Primary Administrator being demoted to a Guest user, effectively locking them out of their own account and compromising the integrity of the application. Organizations using this version of InvoicePlane should prioritize addressing this issue, especially those with multiple administrative users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.