InvoicePlane CVE-2026-49850

Exploitation requires (1) a victim who is an authenticated InvoicePlane administrator with an active session, and (2) that victim to load attacker-controlled content that triggers the vulnerable Invoices::delete() or Invoices::delete_invoice_tax() route, which prior to 1.7.2 accepted state-changing requests without a POST method or CSRF token. Limiting factors: the attack is only possible against instances running before 1.7.2, it cannot succeed without administrator interaction (loading the malicious content while logged in), and the attacker gains no direct authentication - they rely entirely on the victim's session. Impact is confined to deletion of invoice or invoice-tax records.

This is a moderate, not high, real-world priority despite the 7.5 CVSS. The core issue is a CSRF flaw (the fixing commit adds a POST-method check plus verify_csrf_token() on state-changing routes), yet the record is CWE-22 'Path Traversal' with a matching 'Path Traversal' tag - that classification is wrong and should be treated as CSRF/CWE-352. The supplied CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is also internally inconsistent with a CSRF: it sets UI:N, but the description explicitly requires an authenticated administrator to load attacker-controlled content (victim interaction), and it assigns PR:L to the attacker when in CSRF the privilege belongs to the tricked victim, not the attacker. The C:H/I:H/A:H impact is overstated - the described consequence is deletion of an invoice or invoice-tax record, which is an integrity/availability concern with no confidentiality disclosure. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no signal of active or automated exploitation. Net: a legitimate, vendor-confirmed and patched CSRF, but requiring victim interaction and limited to data deletion, warranting routine patching rather than emergency response.

An attacker crafts a web page (or email/forum content) containing an auto-loading request to InvoicePlane's Invoices::delete() or delete_invoice_tax() route and lures a logged-in administrator to open it. Because the routes accepted GET/side-effect requests without a CSRF token, the administrator's authenticated session silently deletes the targeted invoice or tax record. No public exploit code was provided, though the trivial nature of the GET-based deletion makes weaponization straightforward.