InvoicePlane, a self-hosted application for managing invoices, invoices, and payments, was found to expose two deletion routes – Invoices::delete() and Invoices::delete_invoice_tax() – without requiring a POST method or validating a CSRF token. When an authenticated administrator loads attacker‑controlled content that triggers these endpoints, the application can delete an invoice or an invoice tax record outright. This allows the attacker to remove financial data without the administrator’s intent, resulting in a loss of critical business information.

The flaw targets all InvoicePlane installations prior to version 1.7.2. Administrators with valid sessions who access the vulnerable routes are at risk, regardless of user role beyond administrator. The affected routes are explicitly Invoices::delete() and Invoices::delete_invoice_tax().

With a CVSS score of 7.5 the vulnerability is considered high severity. Exploitation requires the attacker to have an authenticated administrator session and to be able to load arbitrary content that sends a request to the vulnerable endpoints. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the lack of CSRF protection and the potential to delete financial records present a serious threat, especially in environments where invoice integrity is critical.