The flaw in InvoicePlane’s Users::form() lets a secondary administrator rewrite the primary administrator’s email because the form lacks an authorization guard and email is not listed as a protected field. By doing so the attacker can trigger the password recovery mechanism that issues a reset token based on the email address, thereby gaining the primary administrator’s account. This is an authentication bypass by user‑controlled key (CWE‑863) that can elevate a secondary administrator’s privileges to full system control.

InvoicePlane (self‑hosted invoicing application) is affected. Vulnerable versions include 1.7.2 and earlier releases that have not incorporated the commit 8616fa4; the issue is addressed in later builds such as 1.7.3 or newer.

The CVSS score of 8.7 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an account with secondary administrator rights, which is typically restricted. Once such an account exists, the exploit can be performed exclusively through the application by editing the primary admin’s email and using the public password‑recovery flow—no remote code execution or network exposure is needed. Until the patch is applied, organizations that retain active secondary administrator accounts face high risk of administrative takeover.