CVE-2026-9412
Improper Access Control in Indian Invoicing System 1.0
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | indian_invoicing_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the SourceCodester Indian Invoicing System 1.0, specifically in an unknown function of the Backend Endpoint component. It allows an attacker to manipulate the system to bypass or improperly enforce access controls. The attack can be performed remotely and affects multiple endpoints within the system.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to improper access control, which means unauthorized users might gain access to sensitive parts of the system or data. This could result in data exposure, unauthorized actions, or other security breaches within the invoicing system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in SourceCodester Indian Invoicing System 1.0 involves improper access controls that can be exploited remotely. Such weaknesses in access control mechanisms can potentially lead to unauthorized access to sensitive data.
Improper access controls may impact compliance with standards and regulations like GDPR and HIPAA, which require strict protection of personal and health-related data. Unauthorized access could result in data breaches, violating these regulations' requirements for confidentiality and security.
However, the provided information does not explicitly state the nature of the data affected or the direct compliance implications.