InvoicePlane EUVD-2026-87126

Requires a victim who is a currently-authenticated InvoicePlane administrator to load attacker-controlled web content in the same browser holding a valid session (UI:R). Affected versions are all releases prior to 1.7.2 running default configurations - no special feature toggle is needed, since the vulnerable delete/destructive methods (Payments::delete, Recurring::stop/delete, User_clients::delete, Users::delete_user_client, Email_templates, Families, Import) ship without CSRF token validation by default. Exploitation is LIMITED by the need for social engineering (the admin must visit the malicious page while logged in) and by the fact that the forged action is restricted to deletion of records the admin session can already delete; there is no data exfiltration and effects are largely recoverable from backups.

This is a CWE-352 cross-site request forgery flaw scored 6.5 (medium) by CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vector is internally consistent with the description: PR:N reflects that the attacker holds no application privileges (the CSRF abuses the victim admin's authenticated session), while UI:R correctly captures that a logged-in administrator must load attacker-controlled content for the forged POST to fire. Impact is integrity-only (I:H, deletion of financial/config records) with no confidentiality or availability metric, which is defensible though I:L could be argued since deletions are typically recoverable from backups. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so this is no public exploit identified at time of analysis - a real-but-not-urgent issue. Real-world risk is bounded by the deployment footprint (niche self-hosted PHP invoicing app) and by the requirement that a currently-authenticated administrator be socially engineered into visiting a malicious page in the same browser session. Net: a legitimate defensive fix worth patching, but not a mass-exploitation priority. The one metadata gap is the absence of a PHP platform tag despite the CodeIgniter/PHP codebase evidenced in the PR diff.

An attacker crafts a web page containing an auto-submitting hidden form (or several) targeting InvoicePlane delete endpoints such as Payments::delete or Recurring::stop, then lures a logged-in InvoicePlane administrator to open it. Because the POST routes never validate a CSRF token, the victim's browser silently submits the requests with the admin's session cookie, deleting financial records, clients, recurring invoices, email templates, or user assignments. No public exploit code is referenced, but the attack is trivial to build as a standard HTML CSRF form.