The flaw in the Invoice System in Laravel allows a remote attacker to manipulate the ID parameter in the /invoice/ endpoint, bypassing authorization checks and gaining unauthorized access to invoice data. The vulnerability is a typical example of improper authorization (CWE-266, CWE-285) where changing a request payload triggers an elevated access level that the application does not validate. An attacker could read or potentially modify confidential invoice information, which could lead to data disclosure and integrity compromises for affected users.

The vulnerability affects code-projects Invoice System in Laravel version 1.0. The affected component is the Invoice Endpoint, specifically the /invoice/ route that accepts an ID argument. No other versions or subcomponents were explicitly listed, so any installation of 1.0 is assumed vulnerable until patched.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of less than 1 % suggests only a very low probability of real-world exploitation at this time. The exploit has been made public, meaning the code to abuse the flaw is available, and the attack can be performed remotely by manipulating HTTP requests. The bug is not listed in the CISA KEV catalog, so there is no current evidence of active exploitation, but the combination of public exploit code and remote trigger warrants monitoring and mitigation.