InvoicePlane CVE-2026-85293

Requires an authenticated administrator with permission to create/edit a client record (to store the payload in client_email, which lacks email-syntax enforcement) and, separately, a second authenticated administrator who must open the related invoice or quote mailer page. The mailer feature must be configured for the affected client. Exploitation is limited by these factors: two distinct high-privilege admin accounts are involved, the victim must perform user interaction (navigating to the mailer page), and only versions up to and including 1.7.2-beta-1 are affected (fixed in 1.7.2). The unescaped sink is specifically the to_email value attribute in the invoice/quote mailer views.

This is a genuine but low-priority stored XSS. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8) accurately captures the constrained real-world risk: exploitation requires PR:H (an authenticated administrator who can edit a client record) AND UI:R (a second authenticated administrator must open the invoice/quote mailer page), and the impact is only C:L/I:L. In practice this is an admin-to-admin attack - both the attacker (who must edit a client) and the victim are high-privilege users - so it offers little privilege escalation beyond what an admin already holds; its main value would be lateral compromise of another admin's session or an insider/backdoored-account scenario. No EPSS score, no CISA KEV listing, and no public exploit code were provided. The advisory (GHSA-477r-xmgc-vcvj) and the fix commit confirm the vulnerability and patch, so the technical facts are solid; the residual risk is low because of the dual high-privilege requirement, required user interaction, and the mailer having to be configured. Note the S:C (scope change) is a defensible XSS convention - the injection crosses from the server-rendered form into the victim's browser context - but reasonable analysts could argue S:U; this does not change the low-severity conclusion.

A malicious or compromised administrator edits a client and sets the client_email field to an attribute-breaking payload (email syntax is not enforced). Later, when the mailer is configured and a different authenticated administrator opens the invoice or quote mailer page for that client, the payload breaks out of the double-quoted value attribute and executes JavaScript in the InvoicePlane origin, letting it perform same-origin actions with the victim admin's session. No public proof-of-concept is identified at time of analysis.