Is there a public PoC exploit available for CVE-2026-7109?

Yes, a public proof-of-concept exploit is available for CVE-2026-7109. Prioritise patching immediately. EPSS: 0.0%.

code-projects Invoice System CVE-2026-7109

Q: What is the CVSS score of CVE-2026-7109?

CVE-2026-7109 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25810 MEDIUM

Improper Authorization (CWE-285)

2026-04-27 VulDB

Authentication Bypass Invoice System In Laravel Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 27, 2026 - 18:37 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 10:30 vuln.today

CVSS changed

Apr 27, 2026 - 10:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 10:00 euvd

EUVD-2026-25810

Analysis Generated

Apr 27, 2026 - 10:00 vuln.today

CVE Published

Apr 27, 2026 - 09:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

Improper authorization in code-projects Invoice System in Laravel 1.0 allows remote unauthenticated attackers to bypass authentication and access the /item API endpoint, resulting in limited confidentiality impact. The vulnerability has a CVSS score of 5.5 (network-accessible, low attack complexity, no privileges required), and publicly available exploit code exists, increasing real-world risk despite the moderate base score.

Technical ContextAI

The vulnerability resides in the /item API endpoint of the code-projects Invoice System, a Laravel-based invoicing application. The root cause is classified under CWE-285 (Improper Authorization), indicating the API endpoint fails to properly validate or enforce access controls before granting access to item resources. Laravel applications typically implement authorization through middleware and policies; this flaw suggests the /item endpoint either lacks authentication middleware entirely or implements insufficient authorization logic that allows unauthenticated or unprivileged users to perform operations they should not be permitted to execute. The attack vector is network-based with no attack complexity, meaning the vulnerability can be triggered with a simple HTTP request to the vulnerable endpoint.

RemediationAI

The primary remediation is to upgrade code-projects Invoice System to a patched version once available from the vendor at https://code-projects.org/. As no specific patch version has been released or documented at the time of this analysis, immediate workarounds should be implemented: restrict network access to the /item API endpoint to authenticated users only by implementing or enforcing authentication middleware on all routes; audit and strengthen authorization logic in the API endpoint to ensure proper role-based access control (RBAC) is enforced; implement Web Application Firewall (WAF) rules to block or monitor suspicious requests to the /item endpoint; disable the /item API endpoint entirely if it is not actively used in production. Monitor the vendor's website and security advisories for a patched release. The trade-off of disabling the endpoint is loss of that API functionality until a patch is applied.