# CVE-2026-100392: InvoicePlane missing object-level authorization in Users::form()

Source: https://junglewise.ai/threats/cve-2026-100392-invoiceplane-is-a-self-hosted-open-source-application-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-100392 · Severity: info · Published 2026-09-28

InvoicePlane is a self-hosted invoicing application. A Secondary Administrator can downgrade the Primary Administrator's role to read-only, stripping all privileges and locking the legitimate owner out of the instance permanently. This occurs because the user-management interface fails to verify that the acting administrator is authorized to modify the Primary Administrator account.

Technologies: [InvoicePlane](https://junglewise.ai/threats/technologies/invoiceplane). Vendors: [InvoicePlane](https://junglewise.ai/threats/vendors/invoiceplane).

## Quick answers

**Is CVE-2026-100392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100392 being exploited in the wild.

**How severe is CVE-2026-100392?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** InvoicePlane 1.7.2.

**Is there a fix for CVE-2026-100392?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100392 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100392?** Check whether you run InvoicePlane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Missing object-level authorization in the Users::form() controller method allows a Secondary Administrator (user_type=1, user_id≠1) to alter the Primary Administrator's (user_id=1) user_type field, downgrading it to Guest/read-only status. The vulnerability arises because form() only checks whether the editor is modifying their own account (is_self_edit), but applies no boundary guard preventing changes to user_id=1. An authenticated attacker with Secondary Administrator privileges can directly target user_id=1 through the user-management UI or HTTP request to perform the privilege escalation.

## Affected products

- InvoicePlane InvoicePlane 1.7.2

## Timeline

- 2026-09-28: disclosed

## References

- [https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-4fxw-x7wr-x6qc](https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-4fxw-x7wr-x6qc)

## Related threats

- [InvoicePlane authorization bypass in guest quote operations](https://junglewise.ai/threats/cve-2026-55561-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authorization bypass in Users::form()](https://junglewise.ai/threats/cve-2026-100371-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane privilege escalation via stale session validation](https://junglewise.ai/threats/cve-2026-88003-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane stored XSS in client email field](https://junglewise.ai/threats/cve-2026-85293-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authentication bypass via type juggling in User_Controller](https://junglewise.ai/threats/cve-2026-85292-invoiceplane-is-a-self-hosted-open-source-application-for)