The vulnerability identified as CVE-2024-43973 affects Stiofan GetPaid invoicing software through version 2.8.11. It is caused by missing authorization checks, which means that access control security levels are incorrectly configured, allowing users with limited privileges to potentially access or perform actions they should not be authorized for. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required, no user interaction needed, and limited confidentiality impact without integrity or availability impact. No vendor patch or advisory is currently available, and the software is not a cloud service, so remediation depends on vendor updates.

The impact is limited to unauthorized access due to missing authorization controls, potentially exposing some confidential information. There is no reported impact on data integrity or availability. The medium severity score reflects that the vulnerability could be exploited remotely by a low-privileged attacker without user interaction, but the confidentiality impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently available, users should monitor vendor communications for updates. Until a fix is released, restricting access to the affected GetPaid installation and reviewing access control configurations may help reduce risk.