CVE-2025-64012

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Dec 16, 2025

CISA due date

—

The record

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.

Affected packages

Ecosystem	Package	Introduced	Fixed