The vulnerability exists in the Backend Endpoint component of SourceCodester Indian Invoicing System 1.0 and allows an attacker to manipulate requests to subvert the normal access control checks. By sending crafted data to an affected endpoint, an attacker can gain authorization that should not be granted, enabling unauthorized data access or modification. The weakness is a classic improper access control flaw, identified as CWE‑266 and CWE‑284. No disclosed privilege escalation beyond the scope of the endpoint was noted, but the damage can extend to confidential financial information handled by the application.

SourceCodester Indian Invoicing System version 1.0 is impacted. All backend endpoints that were reported to be vulnerable must be examined for similar control logic.

The flaw carries a CVSS base score of 5.3 and is considered moderately severe. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely and the exploit is publicly disclosed, meaning attackers can readily use it. While the severity is moderate, the presence of multiple affected endpoints increases the overall exposure. An attacker with internet access to the application can potentially bypass authentication or authorization checks and alter data or access sensitive financial records.