InvoicePlane 1.7.2 contains a missing object‑level authorization check in the Users::form() function. An account that has secondary administrator rights (user_type = 1) but is not the root administrator (user_id ≠ 1) can invoke this form to change the primary administrator’s user_type from 1 (Administrator) to 2 (Guest / read‑only). This change removes all administrative privileges and locks the legitimate owner out of the system, effectively causing a denial of service against the root account. The flaw is a Classic ‘Missing Authorization’ weakness (CWE‑863).

InvoicePlane, version 1.7.2. The flaw is specific to this release; other versions have not been explicitly identified as affected.

The CVSS score of 7 indicates a medium‑high severity vulnerability. Although the EPSS score is not available, the absence of a KEV listing suggests that no widespread exploits are documented. The likely attack vector is via the web interface: an attacker must first authenticate as a secondary administrator, then submit a request to Users::form() with user_id set to 1 to downgrade the root account. Once executed, the attacker effectively removes all legitimate administrative access.