---
id: "CVE-2026-55561"
kind: "vulnerability"
aliases: ["CVE-2026-55561"]
title: "InvoicePlane: guest users can approve or reject other clients' quotes"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["invoiceplane", "package", "php", "self-hosted"]
not_affected_if: ["guest-access-disabled", "no-guest-users"]
published_at: "2026-10-28T23:17:10+00:00"
first_seen_at: "2026-10-28T23:35:49+00:00"
updated_at: "2026-10-28T23:36:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55561", "first_seen_at": "2026-10-28T23:35:49+00:00"}]
---

# InvoicePlane: guest users can approve or reject other clients' quotes

InvoicePlane's guest quote controller skips the client-ownership check on approve and reject, so a guest user assigned to one client can change quote status for any client by iterating quote IDs. The same guest can also mark other clients' quotes as viewed, and status changes send notification emails.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed InvoicePlane version; versions before `1.7.2-beta-1` are affected.
- Review `application/modules/guest/controllers/Quotes.php` for `approve()` and `reject()` calling `approve_quote_by_id` and `reject_quote_by_id` without a `where_in('ip_quotes.client_id', ...)` scope.

## Fix

- Upgrade InvoicePlane to `1.7.2` (or `1.7.2-beta-1` or later).

## Timeline

- 2026-10-28T23:35:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55561

## From the sources

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_