InvoicePlane CVE-2026-85291

Exploitation requires an authenticated administrator account (a secondary/additional admin) on an InvoicePlane instance prior to 1.7.2, plus the existence of at least one other administrator account (e.g., the primary administrator) to target. The attacker sends a direct POST to the Users::change_password()/user form endpoint with the victim's user_id in the URL; the pre-1.7.2 code performs the password update with no check that user_id matches the requester's own session user_id. Limiting factors: requires prior privileged (admin) access, so this is an insider or lateral-movement / privilege-consolidation flaw rather than unauthenticated remote takeover; it also requires a multi-admin deployment for the primary-admin escalation to be meaningful. It does not require user interaction or knowledge of the target's current password.

This is a genuine but privilege-gated authorization flaw (CWE-639, IDOR) rather than a high-urgency remote threat. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N scores 6.5 (Medium): network-reachable and low-complexity, but explicitly requiring high privileges - the attacker must already be an authenticated administrator (a 'secondary administrator' in the description). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: the PR:H requirement plus a niche self-hosted product footprint argues against widespread opportunistic exploitation, and the absence of KEV/EPSS/POC supports treating this as a lower-priority patch rather than an emergency. The real risk is an insider/lateral-movement scenario - a lesser admin seizing the primary administrator account. Patch availability is confirmed (v1.7.2, commit 7af2cdd), which favors routine remediation. Note the C:H/I:H rating reflects full takeover of the targeted account's data and privileges, which is defensible given the primary-admin target.

An organization runs InvoicePlane with more than one administrator account. A secondary/lower-trust administrator sends a crafted POST to the Users::change_password() endpoint supplying the primary administrator's user_id, and - because no object-level authorization check exists - resets that account's password without knowing the current one, then logs in to take over the primary admin account. No public exploit code is identified in the provided intelligence.