CVE-2026-55561 | InvoicePlane up to 1.7.2-beta-0 Guest Quotes Controller Quotes.php quote_id authorization

SecurityVulns
Yanac

A vulnerability labeled as critical has been found in InvoicePlane up to 1.7.2-beta-0. This issue affects the function approve_quote_by_id/reject_quote_by_id/email_quote_status/generate_pdf of the file application/modules/guest/controllers/Quotes.php of the component Guest Quotes Controller. The manipulation of the argument quote_id results in authorization bypass.

This vulnerability is identified as CVE-2026-55561. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More