CVE-2026-26281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26281", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.414Z", "datePublished": "2026-02-18T23:03:08.876Z", "dateUpdated": "2026-02-19T16:47:43.663Z"}, "containers": {"cna": {"title": "InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-ccpx-2v5c-cc24", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-ccpx-2v5c-cc24"}, {"name": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "tags": ["x_refsource_MISC"], "url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6"}], "affected": [{"vendor": "InvoicePlane", "product": "InvoicePlane", "versions": [{"version": "= 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T23:03:08.876Z"}, "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue."}], "source": {"advisory": "GHSA-ccpx-2v5c-cc24", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T16:46:12.464734Z", "id": "CVE-2026-26281", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T16:47:43.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26281", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T16:46:12.464734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T16:47:32.597Z"}}], "cna": {"title": "InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View", "source": {"advisory": "GHSA-ccpx-2v5c-cc24", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "InvoicePlane", "product": "InvoicePlane", "versions": [{"status": "affected", "version": "= 1.7.0"}]}], "references": [{"url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-ccpx-2v5c-cc24", "name": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-ccpx-2v5c-cc24", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "name": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T23:03:08.876Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26281", "state": "PUBLISHED", "dateUpdated": "2026-02-19T16:47:43.663Z", "dateReserved": "2026-02-12T17:10:53.414Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-18T23:03:08.876Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "InvoicePlane", "vendor": "InvoicePlane", "versions": [{"status": "affected", "version": "= 1.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:invoiceplane:invoiceplane:1.7.0:-:*:*:*:*:*:*", "matchCriteriaId": "95F739B4-399F-459D-BF16-5E225A268320", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue."}, {"lang": "es", "value": "InvoicePlane es una aplicaci\u00f3n de c\u00f3digo abierto autoalojada para gestionar facturas, clientes y pagos. Una vulnerabilidad de cross-site scripting (XSS) almacenado en la vista de factura Sumex permite a un usuario autenticado con privilegios de gesti\u00f3n de clientes y facturas ejecutar JavaScript arbitrario en el navegador de cualquier usuario que vea la factura. Esto puede llevar al secuestro de sesi\u00f3n, robo de datos u otras acciones maliciosas en nombre del usuario v\u00edctima. La versi\u00f3n 1.7.1 corrige el problema."}], "id": "CVE-2026-26281", "lastModified": "2026-06-17T10:26:02.267", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26281", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T16:46:12.464734Z", "version": "2.0.3"}}]}, "published": "2026-02-18T23:16:20.400", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-ccpx-2v5c-cc24"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "InvoicePlane", "source": "cna", "vendor": "InvoicePlane"}, "product": "invoiceplane", "vendor": "invoiceplane"}], "analysis": {"en": {"generated_at": "2026-04-17T18:22:08.125420+00:00", "value": {"mitigation_remediation": ["Upgrade InvoicePlane to version 1.7.1 or later to apply the vendor fix", "Restrict client and invoice management privileges to only trusted users to reduce the number of accounts that can create or modify invoices", "Add a content\u2011security\u2011policy header that disallows inline scripts and restricts script sources to prevent execution of injected code"], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) that allows execution of arbitrary JavaScript in the browser of any user viewing an invoice"}, "threat_synthesis": {"affected_systems": "The vulnerable code exists in InvoicePlane version 1.7.0. Users who have been granted client and invoice management privileges on the self\u2011hosted application are potentially able to create or modify invoices that contain malicious scripts. The issue was addressed and fixed in version 1.7.1 released by the vendor.", "description_and_impact": "InvoicePlane contains a stored cross\u2011site scripting flaw in the Sumex invoice view that permits an authenticated user with client and invoice management rights to inject and execute arbitrary JavaScript in the browsers of other users who view the impacted invoice. This capability can lead to session hijacking, data theft, and other malicious actions on behalf of the victim user, exploiting the web application's trust boundary between authenticated user data and client\u2011side scripts.", "risk_and_exploitability": "The CVSS score for this vulnerability is 4.4, indicating moderate severity, and the EPSS score is less than 1%, reflecting a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to be an authenticated user with specific privileges, the victim must load the affected invoice, and the attack vector is browser\u2011side script execution. While the potential impact on confidentiality, integrity, and availability is significant, the likelihood of an attack remains low based on current metrics, though the modest severity warrants timely patching."}}}}, "created": "2026-02-19T10:08:02.251498+00:00", "updated": "2026-04-17T18:30:05.652691+00:00", "vendors": ["invoiceplane", "invoiceplane$PRODUCT$invoiceplane"]}