https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:18:37 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-100392 <p>InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator&#39;s user_type to 2 (Guest / read-only), destroying the root account&#39;s privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.</p> <p>InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator&#39;s user_type to 2 (Guest / read-only), destroying the root account&#39;s privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.</p> https://db.gcve.eu/vuln/fkie_cve-2026-100392