Indian Invoicing System CVE-2026-9412

The attacker must hold a valid, authenticated low-privilege account on the Indian Invoicing System (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by available data. The application must be network-accessible (AV:N), meaning internet-facing or internally reachable deployments are at risk from any authenticated user. Multiple backend endpoints are affected, meaning the vulnerability is not limited to a single obscure function. No additional technical prerequisites (AT:N) or user interaction (UI:N) are required beyond authentication. The primary limiting factor is the authentication requirement: an attacker must have or obtain a valid user account. Organizations with strict user provisioning or single-user deployments have inherently reduced exposure.

The overall risk is low-to-moderate in practice. The CVSS 4.0 base score of 2.1 reflects limited impact (VC:L/VI:L/VA:L) and no scope change to subsequent systems (SC:N/SI:N/SA:N). The E:P modifier in the CVSS 4.0 vector confirms proof-of-concept exploit code exists, corroborated by the publicly available GitHub gist. However, EPSS at 0.04% (11th percentile) indicates very low probability of automated or widespread exploitation in the near term, and absence from CISA KEV confirms no confirmed active exploitation at time of analysis. The requirement for low-level authentication (PR:L) is a meaningful barrier - unauthenticated internet-facing exploitation is not supported by the available vector data. This vulnerability is a realistic priority for organizations running this specific product with multiple user roles, particularly where untrusted or low-trust users have accounts, but it is not a critical emergency for the broader security community. The low EPSS despite a public PoC is consistent with the niche adoption of this specific open-source invoicing application.

An attacker with a low-privilege account on the Indian Invoicing System - such as a standard user or junior staff member - crafts HTTP requests targeting backend endpoints intended for higher-privilege roles (e.g., administrative or financial report endpoints). Leveraging the publicly available PoC from GitHub, the attacker submits requests to multiple restricted endpoints without triggering proper authorization checks, gaining read or write access to data or functions beyond their role. The attack requires no additional complexity or user interaction, making it straightforward for any authenticated user familiar with the PoC.