A flaw in the User Management Handler of code-projects Invoice System in Laravel version 1.0 allows an attacker to manipulate the unknown function in the /user file, resulting in improper authorization. The vulnerability can be exploited remotely, enabling unauthorized actions by bypassing normal access controls. The impact is primarily the ability for an attacker to access or perform operations that they should not be allowed to execute.

The affected product is code-projects Invoice System in Laravel, specifically version 1.0. No other versions or products are listed as impacted.

The CVSS score of 5.3 indicates moderate risk; however, the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web-based request to the /user endpoint, where the attacker can supply malicious input to trigger the improper authorization logic.