InvoicePlane omitted CSRF token validation in its delete routes for payments, recurring invoices, and client records. An attacker can craft a cross‑origin form that an authenticated administrator submits, causing the application to delete critical financial data without the administrator’s intent. The weakness is a classic broken CSRF enforcement that allows unauthorized state‑changing requests.

The vulnerability affects self‑hosted installations of InvoicePlane before version 1.7.2. Any instance that has not applied the fix in commit 215b8c1… or the release tagged v1.7.2 is susceptible. Administrators using older releases are at risk.

The CVSS score of 6.5 indicates moderate severity. EPSS is not provided, and the issue is not flagged in CISA’s KEV catalog, suggesting limited public exploitation data. However, the attack can be carried out in a browser context by an attacker who lures an admin to a malicious site that submits a hidden form. No special system access is required beyond an authenticated admin session, making the exploit relatively straightforward once the admin visits a malicious domain.