The vulnerability is a missing authorization flaw that allows incorrectly configured access control security levels to be bypassed. An attacker exploiting this flaw can read or edit invoices belonging to other clients, thereby affecting confidentiality and integrity of financial information.

The affected product is BoldGrid Client Invoicing by Sprout Invoices. All versions n/a through 20.8.10 are impacted. The issue is present in every release up to and including 20.8.10.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is likely through authenticated access where an attacker with a lower privilege level can exploit the broken access control. No additional exploit conditions or prerequisites are provided in the available data.