Veille CVE

‹ Retour à la liste

CVE-2026-85289

6.5 Moyenne

Publiée le 25/09/2026 à 18:17 · Modifiée le 28/09/2026 à 17:07 · Analyse NVD reportée · Source : security-advisories@github.com

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 6.5 Moyenne security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Faiblesses (CWE)

Références

Ailleurs