# CVE-2026-55561: InvoicePlane authorization bypass in guest quote operations

Source: https://junglewise.ai/threats/cve-2026-55561-invoiceplane-is-a-self-hosted-open-source-application-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-55561 · Severity: info · Published 2026-10-28

InvoicePlane is a self-hosted invoicing and payment management application. Guest users assigned to one client could approve, reject, or view quotes belonging to other clients by manipulating quote identifiers, potentially allowing unauthorized changes to quote statuses and unintended notification emails to be sent.

Technologies: [InvoicePlane](https://junglewise.ai/threats/technologies/invoiceplane). Vendors: [InvoicePlane](https://junglewise.ai/threats/vendors/invoiceplane).

## Quick answers

**Is CVE-2026-55561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55561 being exploited in the wild.

**How severe is CVE-2026-55561?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** InvoicePlane before 1.7.2-beta-1.

**Is there a fix for CVE-2026-55561?** Yes: fixed in 1.7.2-beta-1, 1.7.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55561 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55561?** Check whether you run InvoicePlane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.2-beta-1, 1.7.2

## Technical details

The Guest Quotes controller's approve() and reject() methods failed to scope operations to the user's assigned clients, instead directly calling approve_quote_by_id() and reject_quote_by_id() without client-based access checks. A guest user could exploit this by supplying sequential quote IDs to modify quotes outside their assigned scope, and the generate_pdf() method also marked quotes as viewed before enforcing client scope restrictions.

## Affected products

- InvoicePlane InvoicePlane before 1.7.2-beta-1

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/InvoicePlane/InvoicePlane/commit/424dc44eb54030b93176bb08cba07ba12d7ae451](https://github.com/InvoicePlane/InvoicePlane/commit/424dc44eb54030b93176bb08cba07ba12d7ae451)
- [https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20](https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20)

## Related threats

- [InvoicePlane missing object-level authorization in Users::form()](https://junglewise.ai/threats/cve-2026-100392-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authorization bypass in Users::form()](https://junglewise.ai/threats/cve-2026-100371-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane privilege escalation via stale session validation](https://junglewise.ai/threats/cve-2026-88003-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane stored XSS in client email field](https://junglewise.ai/threats/cve-2026-85293-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authentication bypass via type juggling in User_Controller](https://junglewise.ai/threats/cve-2026-85292-invoiceplane-is-a-self-hosted-open-source-application-for)