InvoicePlane CVE-2025-64012

Requires a valid authenticated InvoicePlane account (any low-privilege user) on version 1.6.1; the attacker then supplies another user's invoice identifier to the invoices/view handler, which returns the data without checking ownership. Limiting factors: exploitation is gated on possessing valid credentials (PR:L), impact is confined to disclosure of invoice data (no modification or denial of service), and it affects the specific InvoicePlane 1.6.1 build at commit debb446c; no user interaction or special non-default configuration is indicated.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects an authenticated information-disclosure IDOR: network-reachable, low attack complexity, but requiring an existing low-privilege account (PR:L) and yielding only limited confidentiality impact with no integrity or availability effect. The signals are internally consistent: EPSS is low at 0.30% (21st percentile), the vulnerability is NOT on the CISA KEV list, and there is no evidence of active exploitation - so exploitation status is: publicly available exploit code exists (a POC gist is referenced), which is distinct from confirmed in-the-wild abuse. The combination of a public POC but low EPSS and no KEV suggests a known, easily reproducible weakness that is nonetheless not being mass-exploited, consistent with the niche footprint of the product. One data caveat: the description attributes the flaw to the 'invoices/view handler' failing ownership verification, but the referenced patch commit diff only shows changes to guest attachment-download URLs (guest/get_file/attachment → guest/get/attachment) in invoice/quote templates, which does not obviously map to the invoices/view ownership check described - verify the exact fixed code path with the vendor. Net: real but low-to-medium priority, best handled on a normal patch cycle unless the InvoicePlane instance holds sensitive billing data shared across many tenants/users.

An attacker with any valid low-privilege InvoicePlane account logs in and requests the invoices/view endpoint while manipulating the invoice identifier, retrieving invoice data belonging to other users because ownership is never verified. A public proof-of-concept exists, and because the vector is network-based with low complexity, the request is trivial to reproduce once authenticated; impact is limited to disclosure of invoice data (confidentiality only).