InvoicePlane's Administrator and Guest Boundary Deserves a Version Check

Invoicing software blends public payment pages with private customer records, quotes, invoice lines, and administrative settings. InvoicePlane's 1.6 documentation describes only Administrator and Guest accounts and states that there is no real separation of ownership between administrators. A newer development line may introduce more roles, but a public deployment must be reviewed against the version it actually runs.

The 1.6 user-account page says all users use the same login URL. A Guest account has a client relationship; a Guest URL can let a client view and pay an invoice without a full account. The client documentation says guest accounts can view quotes and invoices, approve or reject quotes, and pay invoices. Those are useful customer functions, but they also create object-level authorization questions: can one client identify or change another client's invoice or quote?

Measurement scope

A count-only ZoomEye AI probe on 2026-11-16 used sub_type=all, page 1, and page size 1. app="InvoicePlane" returned 487 matches. title="InvoicePlane" returned 398, and http.body="InvoicePlane" returned 823. The app count is the closest product fingerprint in this set, but a match can be a login page, a public invoice page, documentation, or a demo.

The measurements do not show which InvoicePlane version or route is present. They also do not prove that a Guest URL is exposed or that customer data is reachable.

Start with version and account model

Identify the exact release and whether it is the legacy 1.6 line or a newer version with a different permission model. Do not apply a future role design to an older deployment. For 1.6, treat administrator accounts as highly privileged and review each one. A second administrator is not a read-only operator.

For Guest accounts, link every account to the correct client and test the invoice and quote actions. Try changing a numeric or opaque identifier to another client's object. The expected result is a denial tied to the authenticated client, not a redirect that reveals the object's existence.

Treat guest links as bearer credentials

If a Guest URL permits invoice viewing or payment without a login, possession of the URL may be enough to use it. Send it only to the intended client, use HTTPS, and avoid placing it in logs, analytics, referrer headers, or public support pages. Payment-provider callbacks should be verified separately and should not use the guest link as proof of payment.

Define a rotation path for a leaked link. If the application cannot revoke or regenerate the link without changing the underlying invoice identity, document the compensating control. Monitor repeated access from unexpected networks and failed attempts to access adjacent invoice IDs.

Review the administrative edge

Because the legacy model does not separate administrators by ownership, a compromised administrator account may reach all records. Use a dedicated administrator identity, MFA at a reverse proxy or identity gateway if supported, and network restrictions for the admin path. Separate the public customer portal from the admin route where the deployment allows it.

Export and backup paths are also sensitive. An invoice export can include customer names, addresses, tax identifiers, and payment status. Restrict export access, encrypt backups, and record who initiated the export. Do not use a public invoice URL as a backup or support link.

The 487 app matches are a candidate set for version-aware review. The useful question is not simply whether an InvoicePlane page is public. It is whether the deployed version has a coherent administrator boundary and whether Guest links and Guest accounts are scoped to the right client. ZoomEye can find the front door. The application's version and object checks determine what that door opens.

References

1. InvoicePlane, "User Accounts." https://wiki.invoiceplane.com/en/1.6/settings/user-accounts
2. InvoicePlane, "Payments." https://wiki.invoiceplane.com/en/1.6/modules/payments
3. InvoicePlane, "Clients." https://wiki.invoiceplane.com/en/1.6/modules/clients