InvoicePlane CVE-2026-33639

Requires an authenticated administrator account, because the exploited tax_rate_decimal_places value is set through the admin-only Settings page (Settings::index()) - this is the primary limiting factor and matches CVSS PR:H. The affected code path is present by default in InvoicePlane prior to 1.7.2 with no special feature or non-default configuration needed; any version below 1.7.2 is vulnerable once an attacker reaches the settings form. No user interaction beyond the attacker's own submission is required (UI:N), and the ALTER TABLE runs on the normal MySQL/MariaDB backing store. Exploitation is blocked by upgrading to 1.7.2, which integer-casts the value and enforces a 2-3 range.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is internally consistent with the description: the vulnerable tax_rate_decimal_places setting is explicitly 'administrator-controlled', which correctly maps to PR:H. This is the single most important limiting signal - the attacker must already hold administrator credentials to reach Settings::index(), so this is a privilege-escalation-of-impact / post-auth integrity flaw, not a pre-auth mass-exploitation risk. No EPSS score, CISA KEV listing, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The C:H rating is the weakest part of the vendor vector: the injection occurs inside an ALTER TABLE (DDL) statement whose realistic payoff is schema corruption (column removal/alteration), which cleanly supports the described I:H/A:H (permanent financial-data-structure damage and application unavailability) but makes classic data exfiltration harder than a SELECT-based SQLi - I temper confidentiality to C:L. Net: a genuine SQL injection worth patching, but real-world urgency is bounded by the admin prerequisite, so this is a moderate priority rather than an internet-facing emergency.

An authenticated InvoicePlane administrator (or an attacker who has obtained admin credentials via phishing, credential reuse, or a separate session compromise) opens the Settings page and submits a crafted tax_rate_decimal_places value that breaks out of the DECIMAL(5, ...) clause and appends additional SQL to the ip_tax_rates ALTER TABLE statement. The injected clauses drop or alter required columns, permanently corrupting the financial schema and rendering the application unavailable. No public exploit code is identified, but the payload is trivial to construct given the direct string interpolation shown in the patch diff.