InvoicePlane versions before 1.7.2 expose a GET route that stops a recurring invoice without requiring a CSRF token. An authenticated administrator who visits malicious content can trigger the /invoices/recurring/stop/{id} request, causing the selected invoice to be halted. This flaw allows an attacker to interrupt multiple recurring billing cycles, resulting in financial loss and disruption of legitimate business processes.

InvoicePlane self‑hosted invoicing software, affected from the initial release through version 1.7.1. The vulnerability exists only in those releases that lack CSRF validation for the stop route.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, so exploitation likelihood is unknown, and the issue is not listed in the CISA KEV catalog. The attack requires that an attacker can lure an authenticated administrator to a crafted page or otherwise get the admin’s browser to issue the GET request. Because no CSRF token is checked, the request executes automatically and stops the chosen recurring invoice(s).