InvoicePlane uses PHP's loose inequality operator to compare the session's user_type with the role required for access inside User_Controller. This weak comparison allows a crafted session value that is not strictly equal to the required role to pass the check, resulting in an authentication or authorization bypass. The vulnerability is limited to session configurations that use a non‑standard backend capable of returning unexpected scalar types.

Affected systems are installations of the InvoicePlane application running any version before v1.7.2, including 1.7.1 and earlier releases from the open‑source project. The fix was introduced in release v1.7.2.

The CVSS score is 4.8, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, which suggests that exploitation is neither currently widespread nor known to have active attacks. The attack requires the ability to inject a custom session backend or otherwise manipulate the session data, a prerequisite that limits the potential attacker base.