InvoicePlane’s change_password() method accepts a user_id directly from the URL and updates the corresponding account’s password without checking that the requester is authorized to modify that account. An authenticated secondary administrator can target the primary administrator’s account, replace its password, and then log in as the primary administrator. This results in full control over the primary account, exposing all sensitive data, access rights, and actions within the application.

All installations of InvoicePlane running a version earlier than 1.7.2 are vulnerable. The bug exists in the Users::change_password() method and applies to the self‑hosted InvoicePlane application used for managing invoices, clients, and payments.

The CVSS score of 6.5 indicates a moderate severity. With no EPSS information and no listing in CISA KEV, public exploitation is not documented, but the vulnerability is accessible to any authenticated secondary administrator, making the attack vector local to the application. An attacker who can authenticate as a secondary administrator can alter the primary admin’s credentials, compromising the entire system’s confidentiality and integrity.