InvoicePlane CVE-2026-85274

Exploitation requires a victim who is an authenticated InvoicePlane administrator with an active session to load attacker-controlled web content while that session is valid; the vulnerable endpoint is the state-changing GET route /invoices/recurring/stop/{id} in Recurring::stop() which, prior to 1.7.2, accepts requests without CSRF token validation. Limiting factors: only versions before 1.7.2 are affected; the target recurring-invoice IDs must be known or brute-forced; and the impact is confined to stopping recurring billing (no data disclosure or account compromise). No click is needed once the admin loads the page (auto-fetching <img>), but the admin-session precondition (UI:R) meaningfully constrains real-world exploitation.

This is a genuine but moderate-severity CSRF flaw (CWE-352) confirmed by the vendor advisory (GHSA-qf9q-2hxm-4wh9), the fixing PR #1636, commit 2c76ef56, and the v1.7.2 release. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) is internally consistent: the attacker is unauthenticated (PR:N) because CSRF abuses the VICTIM's session, and UI:R correctly reflects that a logged-in administrator must load attacker-controlled content for the forged GET to fire. No EPSS score, no CISA KEV listing, and no public exploit code are present in the intelligence, so this is 'no public exploit identified at time of analysis' - not active exploitation. Note the fix CHANGELOG uses the loaded phrase 'zero-interaction'; that means no click is required (an <img> tag auto-fetches the GET), but it still depends on the admin being authenticated and loading the malicious page, so the practical bar is higher than a fully drive-by remote exploit. The I:H rating is defensible but arguably overstated: the only effect is stopping recurring invoices, a bounded and administratively recoverable state change (the admin can re-enable billing), so the real-world impact is business disruption/financial-loss risk rather than deep data integrity compromise. Overall a real-but-not-urgent priority - patch on a normal cycle.

An attacker crafts a web page (or email) embedding auto-loading resources such as <img src="https://victim-invoiceplane/invoices/recurring/stop/1"> repeated across many recurring-invoice IDs. When an authenticated InvoicePlane administrator visits that content, their browser silently issues the state-changing GET requests, stopping the targeted recurring invoices and interrupting billing. No public proof-of-concept is referenced, though the fix CHANGELOG explicitly describes the trivial <img>-tag technique.