CyberRota Analysis
AI-GeneratedInvoicePlane versions prior to 1.7.2 are vulnerable to unauthorized deletion of invoices and invoice tax records due to insufficient CSRF protection on critical state-changing routes. An authenticated administrator can inadvertently trigger these deletions by loading attacker-controlled content, potentially leading to significant financial data loss. Organizations using InvoicePlane should prioritize upgrading to version 1.7.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent. This issue is fixed in version 1.7.2.