Live › vulnerability › CVE-2026-55561
Go to dashboardInvoicePlane's guest quote controller skips the client-ownership check on approve and reject, so a guest user assigned to one client can change quote status for any client by iterating quote IDs. The same guest can also mark other clients' quotes as viewed, and status changes send notification emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 23:35 UTC. All times on this page are UTC.
Teams running self-hosted InvoicePlane with guest portal access enabled, where guest users are assigned to clients and can log in. Instances without guest accounts, or where guest access is disabled, are not exposed to this flaw.
No product ranges from the sources yet.
1.7.2-beta-1 are affected.application/modules/guest/controllers/Quotes.php for approve() and reject() calling approve_quote_by_id and reject_quote_by_id without a where_in('ip_quotes.client_id', ...) scope.1.7.2 (or 1.7.2-beta-1 or later).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve() and reject() methods in the Guest Quotes controller, application/modules/guest/controllers/Quotes.php, call approve_quote_by_id($quote_id) and reject_quote_by_id($quote_id) directly without the where_in('ip_quotes.client_id', $this->user_clients) scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer quote_id values, and email_quote_status() also sends notification emails. Additionally, generate_pdf() calls mark_viewed($quote_id) before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-55561")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.