This vulnerability in BoldGrid Client Invoicing by Sprout Invoices involves missing authorization checks due to misconfigured access control security levels. It affects versions up to 20.8.1 and could potentially allow unauthorized users to perform actions that should be restricted. The vulnerability was published on January 27, 2025, and no CVSS score or patch information is provided. The product is not a cloud service, and no known exploits have been documented.

The impact of this vulnerability is unauthorized access or actions within the Client Invoicing by Sprout Invoices plugin due to missing authorization controls. Without proper access control, attackers might perform operations that should be restricted, potentially leading to data exposure or manipulation within the invoicing system. However, the exact impact scope is not detailed, and no exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and tighten access control configurations where possible and monitor for updates from BoldGrid or Sprout Invoices regarding patches or workarounds.