This vulnerability in Sushmi-pal Invoice-System up to commit a0a3faa16dee2621b231ae227333f5761607283b allows an attacker with low privileges to remotely manipulate the ID argument in the /profile component of the Profile Workflow, resulting in improper authorization. The flaw enables unauthorized access or actions due to insufficient access control checks. The product uses rolling releases, so specific affected or fixed versions are not clearly defined. The vendor was contacted but did not provide any response or fix information. The CVSS 4.0 base score is 5.3, indicating medium severity.

An attacker with low privileges can remotely exploit this vulnerability to bypass authorization controls in the Profile Workflow component, potentially accessing or modifying data they should not be authorized to. This could lead to unauthorized information disclosure or modification within the Invoice-System. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a fix is released, consider restricting access to the affected /profile endpoint or implementing additional access control checks at the network or application level to mitigate unauthorized access.