This vulnerability in BoldGrid Client Invoicing by Sprout Invoices is due to missing authorization controls, which means that access control security levels are incorrectly configured. This allows users with limited privileges to potentially access or perform actions they should not be authorized to do. The affected versions include all versions up to and including 20.8.13. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires privileges but no user interaction. The impact is primarily on confidentiality, with no integrity or availability impact reported. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

The vulnerability allows unauthorized access due to missing authorization checks, potentially exposing sensitive information (confidentiality impact). There is no reported impact on integrity or availability. The attack requires some level of privileges but no user interaction and can be executed remotely. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently provided, organizations should monitor vendor communications for updates. Until a patch is available, review and tighten access control configurations where possible to limit exposure.