Description
A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-04-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper Authorization
Action: Apply Patch
AI Analysis

Impact

A flaw in the Invoice System in Laravel allows an attacker to manipulate the ID argument in the /profile/ endpoint, causing the application to fail at checking that the requested profile belongs to the authenticated user. This results in unauthorized access to other users’ profile data or potentially enabling modification of sensitive information. The weakness is a classic case of improper authorization (CWE-266, CWE-285), and the bug can be triggered remotely via crafted URL parameters or API calls.

Affected Systems

The vulnerability affects code-projects Invoice System in Laravel, version 1.0. No additional affected versions were identified in the available data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploit in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying no known public exploits. Attackers can exploit the flaw remotely by sending crafted requests to the /profile/ path without needing elevated privileges. The primary risk is unauthorized data disclosure or modification through breached authorization checks.

Generated by OpenCVE AI on April 28, 2026 at 04:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor’s website or repository for an updated release that addresses the /profile/ authorization flaw and install it promptly.
  • Modify the application’s authorization logic so that the ID parameter is validated against the authenticated user’s account before granting access to profile data.
  • Enable application and server logs to monitor for suspicious access attempts to the /profile/ endpoint and configure intrusion detection rules to flag repeated unauthorized ID manipulations.

Generated by OpenCVE AI on April 28, 2026 at 04:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects invoice System In Laravel
Vendors & Products Code-projects
Code-projects invoice System In Laravel

Mon, 27 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Invoice System in Laravel Profile profile improper authorization
Weaknesses CWE-266
CWE-285
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Invoice System In Laravel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-29T13:47:20.141Z

Reserved: 2026-04-26T08:49:01.930Z

Link: CVE-2026-7092

cve-icon Vulnrichment

Updated: 2026-04-29T13:47:11.442Z

cve-icon NVD

Status : Deferred

Published: 2026-04-27T07:16:04.547

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-7092

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T05:00:14Z

Weaknesses