InvoicePlane CVE-2026-54790

Requires an authenticated InvoicePlane administrator account (PR:H): the vulnerable custom_field_table value can only be written by an admin managing custom fields, per the description ('administrator-controlled custom_field_table value'). The injection is second-order - it does not execute at save time but when the custom-field edit form is later opened and Mdl_custom_fields::used() builds its query. Affected versions are all releases prior to 1.7.2. What LIMITS exploitation: the mandatory administrator privilege level, which restricts this to malicious insiders or attackers who have already compromised an admin session, meaning it grants broader database schema read rather than initial unauthenticated access.

This is a genuine second-order SQL injection (CWE-89) but a modest-priority one because exploitation requires administrator privileges. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, 6.0 Medium) is internally consistent with the description: the malicious custom_field_table value can only be stored by an administrator (PR:H), and the injection fires when the custom-field edit form is later opened (a second-order trigger performed by the same privileged operator, so UI:N). The C:H rating is defensible - the source-code evidence confirms the tainted value is concatenated into FROM-table and WHERE-column identifier positions in Mdl_custom_fields::used(), which the description says allows querying arbitrary schema data. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or automated exploitation. The core caveat is the trust model: an attacker must already hold administrator access to InvoicePlane, which substantially blunts real-world urgency - a compromised or malicious admin gaining broader DB read is an escalation-of-scope issue rather than an initial-access one. Signals are consistent (no conflicts between CVSS, CWE, and the confirmed patch), so this is a real-but-not-urgent Medium: patch on a normal cycle.

An authenticated InvoicePlane administrator (or an attacker who has already seized an admin session) saves a custom field with a crafted custom_field_table value containing SQL syntax, which is stored without validation. When the custom-field edit form is subsequently opened, Mdl_custom_fields::used() concatenates that stored value into the query's table and column identifier positions, executing the injected SQL and returning arbitrary schema data or triggering application errors/DoS. No public exploit code is identified at time of analysis; exploitation is deterministic (AC:L) but gated behind administrator privilege (PR:H).