Is there a public PoC exploit available for CVE-2026-9410?

Yes, a public proof-of-concept exploit is available for CVE-2026-9410. Prioritise patching immediately. EPSS: 0.0%.

Invoice-System CVE-2026-9410

Q: What is the CVSS score of CVE-2026-9410?

CVE-2026-9410 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31612 LOW

Improper Authorization (CWE-285)

2026-05-25 VulDB

GHSA-65mh-5324-gg43

Authentication Bypass Invoice System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:56 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file /profile of the component Profile Workflow. Such manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Sushmi-pal Invoice-System (up to commit a0a3faa16dee2621b231ae227333f5761607283b) enables authenticated low-privileged users to manipulate the ID parameter on the /profile endpoint to access or modify profile records belonging to other users - a classic horizontal privilege escalation pattern. The CVSS 4.0 score is 2.1 (Low), reflecting constrained integrity-only impact with no confidentiality or availability consequence, and a proof-of-concept exploit has been publicly disclosed on GitHub. No patch exists; the vendor did not respond to responsible disclosure, and no public exploit is confirmed in CISA KEV.

Technical ContextAI

The vulnerable component is the Profile Workflow at the /profile route of the Invoice-System web application, a PHP/web-based invoicing tool by the GitHub user sushmi-pal (CPE: cpe:2.3:a:sushmi-pal:invoice-system:*:*:*:*:*:*:*:*). CWE-285 (Improper Authorization) identifies the root cause as a failure to enforce that the authenticated session owner is the same as the resource owner referenced by the ID parameter - commonly known as an Insecure Direct Object Reference (IDOR). The application relies entirely on rolling releases via direct Git commits, with no discrete versioned releases, making automated patching and version tracking impossible for downstream users.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure, and no remediated commit has been identified beyond the affected commit a0a3faa16dee2621b231ae227333f5761607283b. Operators should implement server-side ownership validation on the /profile endpoint to enforce that the authenticated session's user identity matches the resource owner identified by the ID parameter before processing the request; this addresses the CWE-285 root cause directly. As a compensating control, restricting Invoice-System access to internal or trusted networks reduces the AV:N attack surface, though this may limit legitimate remote use. Deploying a WAF rule to flag or block unexpected ID enumeration patterns on /profile requests can provide detection and partial mitigation with low side effects. Access logs should be reviewed for anomalous cross-user profile access patterns. The public PoC is available at https://gist.github.com/c4ttr4ck/c35c134709743deb7dfad5b878295402 and can assist developers in reproducing and fixing the issue. See also https://vuldb.com/vuln/365391.