This vulnerability (CVE-2026-65499) affects PeproDev Ultimate Invoice versions up to 2.2.6 and is categorized as a missing authorization issue (CWE-862). It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized access to certain application functions or data. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality and integrity impacts are low, with no availability impact reported. There is no vendor advisory or patch available at this time.

The vulnerability allows unauthenticated attackers to bypass authorization controls, which could lead to unauthorized access to sensitive information or limited modification of data within the affected application. The impact on confidentiality and integrity is low, and availability is not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application where possible and monitor for unusual access patterns. Avoid exposing the application to untrusted networks. Follow vendor communications for updates on patches or mitigations.