{"id":"CVE-2026-55561","kind":"vulnerability","aliases":["CVE-2026-55561"],"related":[],"title":"InvoicePlane: guest users can approve or reject other clients' quotes","description":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.","summary":"InvoicePlane's guest quote controller skips the client-ownership check on approve and reject, so a guest user assigned to one client can change quote status for any client by iterating quote IDs. The same guest can also mark other clients' quotes as viewed, and status changes send notification emails.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["invoiceplane","package","php","self-hosted"],"not_affected_if":["guest-access-disabled","no-guest-users"],"how_to_check":"- Check the installed InvoicePlane version; versions before `1.7.2-beta-1` are affected.\n- Review `application/modules/guest/controllers/Quotes.php` for `approve()` and `reject()` calling `approve_quote_by_id` and `reject_quote_by_id` without a `where_in('ip_quotes.client_id', ...)` scope.","fix":"- Upgrade InvoicePlane to `1.7.2` (or `1.7.2-beta-1` or later).","status":"open","published_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:43+00:00","updated_at":"2026-10-28T23:36:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T23:36:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade InvoicePlane to `1.7.2` (or `1.7.2-beta-1` or later).","reach":"internet","title":"InvoicePlane: guest users can approve or reject other clients' quotes","impact":"medium","summary":"InvoicePlane's guest quote controller skips the client-ownership check on approve and reject, so a guest user assigned to one client can change quote status for any client by iterating quote IDs. The same guest can also mark other clients' quotes as viewed, and status changes send notification emails.","category":"package","nicknames":[],"who_cares":["self-hosted","invoiceplane","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"A guest user changes other clients' quote statuses and triggers emails.","analyst_note":"","how_to_check":"- Check the installed InvoicePlane version; versions before `1.7.2-beta-1` are affected.\n- Review `application/modules/guest/controllers/Quotes.php` for `approve()` and `reject()` calling `approve_quote_by_id` and `reject_quote_by_id` without a `where_in('ip_quotes.client_id', ...)` scope.","needs_analyst":false,"not_affected_if":["guest-access-disabled","no-guest-users"],"who_is_affected":"Teams running self-hosted InvoicePlane with guest portal access enabled, where guest users are assigned to clients and can log in. Instances without guest accounts, or where guest access is disabled, are not exposed to this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3556,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':93C,212C '-2026':12A,15A '-55561':13A,16A '1.7.2':91C,210C,218C 'addit':179C 'allow':192C 'also':61B,175C 'anoth':159C,198C 'applic':82C 'application/modules/guest/controllers/quotes.php':120C 'approv':5A,35B,97C,111C,122C 'assign':42B,108C,153C 'belong':101C 'beta':92C,211C 'call':121C,182C 'chang':47B,70B,158C 'check':33B,188C 'client':9A,31B,45B,52B,64B,86C,104C,109C,144C,156C,160C,190C,199C 'client-ownership':30B 'control':27B,119C 'cve':11A,14A 'direct':135C 'email':73B,172C,178C 'fix':207C 'generat':180C 'guest':2A,25B,40B,59B,94C,117C,151C,194C 'host':22B,79C 'id':56B,125C,127C,132C,134C,141C,169C,186C 'integ':167C 'invoic':85C 'invoiceplan':1A,17B,23B,74C 'ip_quotes.client':140C 'issu':205C 'iter':54B 'manag':84C 'mark':62B,183C,197C 'method':114C,148C 'notif':72B,177C 'one':44B,155C 'open':80C 'ownership':32B 'packag':18B 'payment':88C 'pdf':181C 'php':19B 'prior':89C 'quot':10A,26B,48B,55B,65B,100C,118C,123C,126C,130C,133C,162C,168C,173C,185C,201C 'reject':7A,37B,99C,113C,129C 'scope':145C,191C 'self':21B,78C 'self-host':20B,77C 'send':71B,176C 'sequenti':166C 'sibl':147C 'skip':28B 'sourc':81C 'stabl':216C 'status':49B,69B,163C,174C 'subsequ':215C 'suppli':165C 'use':149C 'user':3A,41B,95C,143C,152C,195C 'valu':170C 'version':209C,217C 'view':67B,184C,203C 'without':136C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted InvoicePlane with guest portal access enabled, where guest users are assigned to clients and can log in. Instances without guest accounts, or where guest access is disabled, are not exposed to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55561","severity":null,"published_at":"2026-10-28T23:17:10+00:00","modified_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}