A flaw in the /item API endpoint of code‑projects Invoice System in Laravel 1.0 permits attackers to manipulate requests and bypass normal authorization checks. Without proper credentials, an adversary can create, update, retrieve, or delete invoice items, leading to unauthorized data exposure and potential integrity compromise of financial records. The weakness is classified as an improper authorization flaw (CWE‑266 and CWE‑285), allowing privileged actions to be performed by unauthenticated or unauthorised users.

The vulnerability affects the code‑projects Invoice System in Laravel, version 1.0. It resides in the /item endpoint of the system’s API component; no other products or versions are listed. The endpoint is exposed over the network and can be targeted by external actors.

The CVSS score of 6.9 indicates a moderate severity vulnerability, while the EPSS score of <1% signals a low likelihood of exploitation in the wild. The flaw is not included in the CISA KEV catalog, and the publicly available exploit demonstrates that an attacker can trigger the abuse remotely, even without prior authentication. Successful exploitation could give the attacker unauthorized access to invoice data and potentially enable lateral movement if other privileged functionalities are similarly affected.