CVE-2025-64012: 
NixOS vulnerability analysis and mitigation

CVE-2025-64012 is an Insecure Direct Object Reference (IDOR) / Incorrect Access Control vulnerability in InvoicePlane v1.6.1. The invoices/view handler fails to verify ownership before returning invoice data, allowing authenticated low-privileged users to access invoices belonging to other users by manipulating the invoice ID parameter. The vulnerability was disclosed on December 16, 2025, and affects InvoicePlane version 1.6.1 (commit debb446c). It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, PoC Gist).

The root cause is classified under CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key). The invoices/view endpoint accepts a user-controlled invoice_id parameter and returns the corresponding invoice data without verifying that the requesting user owns or has permission to view that invoice — a classic IDOR pattern. An attacker only needs a valid authenticated session (low-privilege account) and knowledge of another user's invoice ID to exploit this over the network with no user interaction required. A public proof-of-concept demonstrating the exploitation technique was published by researcher Tarek Ramadan on December 15, 2025 (PoC Gist).

Successful exploitation allows an authenticated attacker to read invoice data belonging to other users or organizations without authorization, resulting in unauthorized disclosure of financial records, customer information, and transaction details. This constitutes a confidentiality breach with no integrity or availability impact. In multi-tenant deployments, this could violate tenant isolation, expose competitive business information, and result in privacy regulation violations (PoC Gist, Feedly).

A public proof-of-concept is available as a GitHub Gist published by the discoverer, Tarek Ramadan, demonstrating the IDOR technique against InvoicePlane v1.6.1. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (PoC Gist, Feedly).

1. Authenticate as a low-privilege user: Log in to the InvoicePlane v1.6.1 instance as any valid user (User B).
2. Identify the invoice view endpoint: Navigate to one of your own invoices and observe the URL pattern, e.g., /invoices/view/{invoice_id}.
3. Enumerate or guess invoice IDs: Since invoice IDs are typically sequential integers, increment or decrement the invoice_id value to reference invoices belonging to other users or organizations.
4. Send the crafted request: Access /invoices/view/{target_invoice_id} where {target_invoice_id} belongs to another user (User A).
5. Retrieve unauthorized invoice data: The server returns the full invoice details — including financial data, customer information, and transaction records — without performing any ownership verification (PoC Gist).

• Network: Repeated HTTP GET requests to /invoices/view/{id} with sequentially or randomly varying invoice IDs from a single authenticated session.
• Logs: Web server access logs showing a single user account accessing a large number of distinct invoice IDs in a short time window, particularly IDs not associated with that user's account.
• Application Logs: Patterns of invoice view requests where the authenticated user ID does not match the owner of the requested invoice ID (if application-level logging captures this context).

The vulnerability has been addressed in the InvoicePlane GitHub repository via commit debb446ceaa84efc136987fc1e21b268f34e47b0. Administrators should apply this patch immediately to all InvoicePlane 1.6.1 installations. As an interim measure, restrict access to the InvoicePlane instance to trusted networks or authenticated VPN users, and audit application access logs for signs of unauthorized invoice access. Additionally, implement server-side ownership validation on all invoice-related endpoints to ensure the requesting user's session matches the invoice owner before returning data (GitHub Commit, Feedly).