This vulnerability affects the Invoice Endpoint component of code-projects Invoice System in Laravel version 1.0. It allows an attacker to perform improper authorization by manipulating the ID parameter in requests to the /invoice/ path. The flaw permits unauthorized access or actions due to insufficient authorization checks. The vulnerability is remotely exploitable without requiring user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been released as of the published date.

Successful exploitation could allow an attacker with limited privileges to bypass authorization controls on the invoice endpoint, potentially accessing or modifying invoice data they should not have permission to. This could lead to unauthorized data exposure or modification within the affected system. The vulnerability does not require user interaction and can be triggered remotely, increasing its risk. However, there are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /invoice/ endpoint to trusted users only and monitor for unusual activity related to invoice ID parameters. Avoid exposing the vulnerable functionality to untrusted networks where possible.