This vulnerability affects Webkul Bagisto versions 2.4.0 through 2.4.6 in the Invoice Mass Status Update feature. The issue is a missing authorization check in the /admin/sales/invoices/mass-update/state endpoint, enabling remote attackers with high privileges to perform unauthorized state changes on invoices. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), indicating network attack vector, low impact on integrity, and no user interaction required. Public exploit code exists, but no confirmed exploitation in the wild is reported. The vendor was contacted early, but no patch information is available.

An attacker with high privileges can remotely manipulate invoice states without proper authorization, potentially leading to unauthorized changes in invoice processing. The impact is limited to integrity with low severity, and no direct confidentiality or availability impact is indicated. The vulnerability could affect business processes relying on invoice status accuracy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted administrators only and monitor for suspicious activity related to invoice state changes.