CVE-2025-64012: Invoiceplane

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.

Affected products

• Invoiceplane Invoiceplane: version 1.6.1 only

Published 2025-12-16. Last modified 2026-06-17.