InvoicePlane versions prior to 1.7.2 do not clear an administrative session after a role downgrade. The application trusts the user_type value stored in a session rather than rechecking the database. As a result, an account that is downgraded from administrator can continue to make requests that require admin rights until the session expires or the user logs out. The vulnerability allows the downgraded user to actively restore the administrator role by submitting a form that updates the user_type back to 1, thereby keeping the administrative privileges for a second time. This flaw is a classic privilege escalation because an account that should no longer have elevated rights can permanently recover it.

The issue affects the self‑hosted open‑source InvoicePlane application. All deployments of InvoicePlane prior to version 1.7.2 are impacted. The vulnerable code resides in the Admin_Controller module which validates role changes but does not revoke active sessions. Specific vendor/product identification is provided by the CNA as InvoicePlane:InvoicePlane.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified but the flaw can be abused by any user who has sufficient privileges to downgrade another administrator. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already have administrative access to downgrade another account, then cause that downgraded account to continue using its existing session. Once the session is active, the attacker can exploit the role form to persistently regain administrative privileges. The risk is moderate‑high for environments with multiple administrators or weak session invalidation practices.