InvoicePlane CVE-2026-55561

Exploitation requires an authenticated low-privilege guest account bound to at least one client (PR:L): the attacker must be able to reach the authenticated guest portal routes /guest/quotes/approve/{id} and /guest/quotes/reject/{id}. No special non-default configuration, plugin, or user interaction from a victim is needed - the flaw is present in the standard guest quote workflow of InvoicePlane prior to 1.7.2-beta-1 because approve_quote_by_id()/reject_quote_by_id() and mark_viewed() run without client_id scoping. Limiting factors: the attacker needs valid guest credentials (not fully unauthenticated), quote_id values are sequential integers so enumeration is trivial, and impact is confined to altering quote status, marking quotes viewed, and generating notification emails rather than reading or exfiltrating other clients' quote contents.

This is a genuine but modest-severity authorization flaw (IDOR, CWE-639), not an inflated high-CVSS issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 5.3) is internally consistent with the mechanism: a logged-in guest reaches the vulnerable endpoint over the network (AV:N) with no special timing or user interaction (AC:L/AT:N/UI:N), but needs at least a valid guest client login (PR:L), and the impact is limited to integrity (VI:L) - changing another client's quote status and triggering notification emails - with no confidentiality or availability loss (VC:N/VA:N). The vuln.today priority is 'this_month', not act_now or emergency, which aligns with medium severity. No CISA KEV listing and no EPSS score are present in the input, so widespread automated exploitation is not indicated; the GHSA advisory does include a concrete step-by-step Burp Suite PoC, so exploitability against unpatched instances is well established even though no packaged exploit code is confirmed. The main caveats: no EPSS value is available to gauge exploitation probability, and real-world risk is tempered by the limited impact (quote status manipulation and 'viewed' marking) rather than data disclosure or code execution.

An attacker registers or is provisioned as a guest user tied to Client A and logs into the InvoicePlane guest portal. Observing that approving their own quote calls /guest/quotes/approve/1, they replay the request with a different sequential integer quote_id (e.g. 3) belonging to Client B, flipping that unrelated client's quote to Approved or Rejected and causing a status-notification email to be sent. A public PoC reference demonstrating exactly this with Burp Suite exists in the GHSA advisory; it is not verified as packaged working exploit code.