InvoicePlane CVE-2026-85292

Requires the InvoicePlane instance to be configured with a non-standard/custom session backend that returns unexpected scalar types (non-string values such as integers or booleans) for the session user_type key; against the default CodeIgniter session store (string values) the loose != check behaves correctly and the bypass does NOT occur. The vulnerable code path is the User_Controller constructor authorization gate comparing session user_type (required_key) against the required role (required_val). Limiting factors: exploitation is entirely contingent on this atypical, operator-chosen session configuration (making it non-default and raising attack complexity), affects only versions prior to 1.7.2, and yields only limited (low) confidentiality/integrity impact per the vendor and CVSS.

This is a high-CVSS-context-but-genuinely-low-real-risk authorization flaw. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) already signals modest impact (C:L/I:L, no availability) and elevated attack complexity (AC:H), and the vendor/GitHub advisory (GHSA-346c-gqqq-mrm2) rates the fix 'Low'. The decisive limiter is stated plainly in the description: the type-juggling bypass only materializes 'under a non-standard session backend that returns unexpected scalar types.' CodeIgniter's default session storage returns strings, so the loose != comparison behaves correctly out of the box - meaning stock InvoicePlane deployments are NOT exploitable, which is why AC:H is appropriate. No EPSS score, no CISA KEV listing, and no public exploit are present in the input. PR:N in the vector indicates no authentication is required, but exploitation is gated on an operator-chosen, atypical session configuration, so widespread opportunistic exploitation is implausible; any real risk is confined to bespoke deployments. Signals are internally consistent (low CVSS + Low vendor rating + no exploitation evidence), so this is a hygiene/defense-in-depth fix rather than an urgent patch priority.

An InvoicePlane instance is deployed with a custom/non-default session backend (e.g., a driver or store that returns integers, booleans, or other non-string scalars for the stored user_type). An unauthenticated or low-context attacker interacts with the app such that the session-provided user_type is a scalar that PHP's loose != operator juggles into equaling the required role, passing the User_Controller authorization gate and granting access to a protected/privileged area. No public exploit code is identified at time of analysis, and the attack is only reproducible against the atypical session configuration.