InvoicePlane CVE-2026-88003

Exploitation requires the attacker to have previously held an InvoicePlane administrator account (user_type=1) with a live authenticated session, and then to be downgraded (or deactivated) by another administrator WITHOUT logging out - the stale session's cached user_type is what authorizes continued admin access. The attacker then uses the Users::form() endpoint to rewrite their own user_type back to 1. Limiting factors: this only occurs in multi-administrator deployments where role downgrades happen, requires the downgraded session to remain active at the time of exploitation (the AT:P timing/attack requirement), and requires prior high-privilege access (PR:H) - it is not exploitable by an unauthenticated or ordinary low-privilege user against a default single-admin install.

This is a CWE-863 broken-access-control (privilege-retention) flaw in InvoicePlane prior to 1.7.2. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H = 7.5 High) is internally consistent with the described mechanism: exploitation requires an already-authenticated high-privilege actor (PR:H - the victim must have been an administrator with an active session) and a specific timing condition (AT:P - the downgrade must occur while the target session is still live), while the outcome is full retention/restoration of admin control (VC/VI/VA:H). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is MODERATE-to-LOW rather than the raw 7.5 suggests: this is not remote unauthenticated compromise but an insider/privilege-retention scenario where the attacker must have already held admin rights and been downgraded by another admin - a narrow window in a specific multi-admin workflow. The source-code diff strongly corroborates the root cause (session user_type snapshot trusted instead of re-reading ip_users), so the technical claim is well-substantiated even absent exploitation telemetry. Note the AT:P attack-requirement (active-session timing) is the key limiter that keeps this from being trivially automatable.

A user who was previously granted administrator rights is downgraded by another administrator, but keeps their existing authenticated session open. Because Admin_Controller authorizes requests from the session's stale user_type snapshot rather than re-checking ip_users.user_type, the downgraded user calls Users::form() to reset their own user_type back to 1, restoring admin in the database and making the escalation persistent across future logins. No public exploit code is identified, but the attack is a small number of ordinary authenticated HTTP requests requiring no special tooling.