EUVD-2026-31611
GHSA-h4cp-jfrq-c2fx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file /user of the component User Management Handler. This manipulation of the argument role causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in Sushmi-pal Invoice-System exposes its User Management Handler to privilege escalation by authenticated remote attackers who manipulate the role argument on the /user endpoint. Affected instances include all code up to commit a0a3faa16dee2621b231ae227333f5761607283b; the project uses a rolling release model with no discrete versioning. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.03% and SSVC rates the attack as non-automatable with only partial technical impact - no confirmed active exploitation (CISA KEV) has been identified.
Technical ContextAI
Invoice-System is a web-based invoicing application developed by Sushmi-pal (CPE: cpe:2.3:a:sushmi-pal:invoice-system:*:*:*:*:*:*:*:*). The vulnerable component is the User Management Handler, reachable via the /user HTTP endpoint. CWE-285 (Improper Authorization) identifies the root cause: the application fails to enforce access controls on the role parameter server-side, allowing an authenticated user to supply an arbitrary role value and have it accepted without verification against the user's actual permission level. This is a classic parameter-tampering privilege escalation pattern, where trust is incorrectly placed in user-supplied role data rather than deriving role from a server-authoritative session context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the endpoint is network-exposed, requires no complex attack setup, and demands only a low-privilege authenticated session.
RemediationAI
No vendor-released patch is available at time of analysis - the vendor did not respond to coordinated disclosure. Operators running Invoice-System should immediately audit the /user endpoint's User Management Handler to enforce server-side role validation: the role value must be derived exclusively from the authenticated session context stored server-side, never from user-supplied request parameters. As a compensating control, restrict access to the /user endpoint to verified administrator IP ranges or enforce a web application firewall rule that blocks non-administrative accounts from submitting role parameter changes - note this requires accurate role mapping at the perimeter and may break legitimate low-privilege flows if misconfigured. Audit application logs for unexpected role-change events as a detection measure. The public exploit is documented at https://gist.github.com/c4ttr4ck/c891dd0fa550e910a1724cbd96d93a80 and can be used to verify whether a given deployment is affected. The VulDB advisory at https://vuldb.com/vuln/365390 should be monitored for any vendor response or upstream fix.
More in Invoice System
View allSame weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today