This vulnerability in Sushmi-pal Invoice-System up to commit a0a3faa16dee2621b231ae227333f5761607283b allows remote attackers to manipulate the 'role' argument within the User Management Handler component's /user file, resulting in improper authorization. The issue permits unauthorized actions due to insufficient validation of user roles. The rolling release nature of the product means no fixed version is currently identified. The vendor has not provided any advisory or patch, and the exploit is publicly available.

Successful exploitation could allow an attacker with limited privileges to escalate their authorization level or perform unauthorized actions within the Invoice-System. This could lead to unauthorized access to sensitive invoice or user management functions. However, the CVSS score of 5.3 indicates a medium impact, reflecting that some privileges are required and the impact on confidentiality, integrity, or availability is limited.

No official patch or remediation is currently available from the vendor, who has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is provided, restricting network access to the affected component and applying strict access controls where possible may reduce exposure. Review and harden role assignment and authorization logic if custom modifications are possible.