# InvoicePlane vulnerabilities Source: https://junglewise.ai/threats/technologies/invoiceplane Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/invoiceplane.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in InvoicePlane: 0 in the last 7 days and 16 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55561, was published on 28 October 2026. 1 vulnerability in the last four weeks, down 93% on the four before (15). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 16 - All time: 17 (1 critical, 0 exploited in the wild) ## About InvoicePlane Open-source web application for creating and managing invoices and payments. ## Latest InvoicePlane vulnerabilities - [CVE-2026-55561: InvoicePlane authorization bypass in guest quote operations](https://junglewise.ai/threats/cve-2026-55561-invoiceplane-is-a-self-hosted-open-source-application-for) (info, published 28 Oct 2026) - [CVE-2026-100392: InvoicePlane missing object-level authorization in Users::form()](https://junglewise.ai/threats/cve-2026-100392-invoiceplane-is-a-self-hosted-open-source-application-for) (info, published 28 Sep 2026) - [CVE-2026-100371: InvoicePlane authorization bypass in Users::form()](https://junglewise.ai/threats/cve-2026-100371-invoiceplane-is-a-self-hosted-open-source-application-for) (info, published 28 Sep 2026) - [CVE-2026-88003: InvoicePlane privilege escalation via stale session validation](https://junglewise.ai/threats/cve-2026-88003-invoiceplane-is-a-self-hosted-open-source-application-for) (info, published 25 Sep 2026) - [CVE-2026-85293: InvoicePlane stored XSS in client email field](https://junglewise.ai/threats/cve-2026-85293-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 4.8, published 25 Sep 2026) - [CVE-2026-85292: InvoicePlane authentication bypass via type juggling in User_Controller](https://junglewise.ai/threats/cve-2026-85292-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 4.8, published 25 Sep 2026) - [CVE-2026-85291: InvoicePlane Users::change_password object-level authorization bypass](https://junglewise.ai/threats/cve-2026-85291-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-85290: InvoicePlane log injection in Cron controller](https://junglewise.ai/threats/cve-2026-85290-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 5.3, published 25 Sep 2026) - [CVE-2026-85289: InvoicePlane missing CSRF token validation in delete methods](https://junglewise.ai/threats/cve-2026-85289-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-85274: InvoicePlane CSRF bypass in recurring invoice stop](https://junglewise.ai/threats/cve-2026-85274-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-54790: InvoicePlane second-order SQL injection in custom field table](https://junglewise.ai/threats/cve-2026-54790-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6, published 25 Sep 2026) - [CVE-2026-50547: InvoicePlane local file inclusion in invoice XML generation](https://junglewise.ai/threats/cve-2026-50547-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.5, published 25 Sep 2026) - [CVE-2026-49850: InvoicePlane CSRF on invoice deletion endpoints](https://junglewise.ai/threats/cve-2026-49850-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.5, published 25 Sep 2026) - [CVE-2026-39372: InvoicePlane EXIF metadata disclosure in image attachments](https://junglewise.ai/threats/cve-2026-39372-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 4.9, published 25 Sep 2026) - [CVE-2026-39353: InvoicePlane arbitrary code execution in template inclusion](https://junglewise.ai/threats/cve-2026-39353-invoiceplane-is-a-self-hosted-open-source-application-for) (critical, CVSS 9.1, published 25 Sep 2026) - [CVE-2026-33639: InvoicePlane SQL injection in tax rate decimal setting](https://junglewise.ai/threats/cve-2026-33639-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2025-64012: InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify…](https://junglewise.ai/threats/cve-2025-64012-invoiceplane-commit-debb446c-is-vulnerable-to-incorrect-access) (medium, CVSS 4.3, published 16 Dec 2025) ## Most severe InvoicePlane vulnerabilities - [CVE-2026-39353: InvoicePlane arbitrary code execution in template inclusion](https://junglewise.ai/threats/cve-2026-39353-invoiceplane-is-a-self-hosted-open-source-application-for) (critical, CVSS 9.1, published 25 Sep 2026) - [CVE-2026-50547: InvoicePlane local file inclusion in invoice XML generation](https://junglewise.ai/threats/cve-2026-50547-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.5, published 25 Sep 2026) - [CVE-2026-49850: InvoicePlane CSRF on invoice deletion endpoints](https://junglewise.ai/threats/cve-2026-49850-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.5, published 25 Sep 2026) - [CVE-2026-33639: InvoicePlane SQL injection in tax rate decimal setting](https://junglewise.ai/threats/cve-2026-33639-invoiceplane-is-a-self-hosted-open-source-application-for) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-85291: InvoicePlane Users::change_password object-level authorization bypass](https://junglewise.ai/threats/cve-2026-85291-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-85289: InvoicePlane missing CSRF token validation in delete methods](https://junglewise.ai/threats/cve-2026-85289-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-85274: InvoicePlane CSRF bypass in recurring invoice stop](https://junglewise.ai/threats/cve-2026-85274-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-54790: InvoicePlane second-order SQL injection in custom field table](https://junglewise.ai/threats/cve-2026-54790-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 6, published 25 Sep 2026) - [CVE-2026-85290: InvoicePlane log injection in Cron controller](https://junglewise.ai/threats/cve-2026-85290-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 5.3, published 25 Sep 2026) - [CVE-2026-39372: InvoicePlane EXIF metadata disclosure in image attachments](https://junglewise.ai/threats/cve-2026-39372-invoiceplane-is-a-self-hosted-open-source-application-for) (medium, CVSS 4.9, published 25 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 93% on the four before (15). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 13 | 1 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "InvoicePlane vulnerabilities", https://junglewise.ai/threats/technologies/invoiceplane, 9 November 2026.