This vulnerability in Sushmi-pal Invoice-System up to commit a0a3faa16dee2621b231ae227333f5761607283b allows remote attackers with low privileges to manipulate the 'role' argument in the User Management Handler (/user) component, resulting in improper authorization. The issue enables unauthorized actions due to insufficient access control checks. The product uses a rolling release model, and no vendor response or patch information is available. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low privileges required, no user interaction, and limited impact on confidentiality and integrity.

An attacker with low privileges can remotely exploit this vulnerability to bypass proper authorization controls by manipulating the role parameter. This may allow unauthorized access or actions within the user management functionality, potentially leading to privilege escalation or unauthorized data access. However, the impact is limited as the vulnerability does not affect confidentiality or availability directly and requires some level of privilege to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates or community patches. Until a fix is released, restrict access to the affected component where possible and review user roles and permissions to minimize risk.