CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Explanation of Vulnerability in Simple Terms
Client Invoicing by Sprout Invoices versions 20.8.7 and earlier lack proper authorization checks, allowing authenticated users to modify invoice data they should not have access to. An attacker with a low-privilege account can alter invoices belonging to other users or organizations. The vulnerability requires an existing user account but no additional user interaction.
What an attacker can do
Modify invoices belonging to other users or organizations without authorization.
Potential impact on your site
Invoice data integrity is at risk; users may alter financial records they should not control.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
