Sushmi-pal Invoice-System User Management user improper authorization

Vulnerability

The User Management Handler endpoint /user in Sushmi-pal Invoice-System (up to commit a0a3faa16dee2621b231ae227333f5761607283b) lacks effective authorization controls. The controller accepts attacker-controlled role data, and the routes are not protected by admin-only middleware. This allows any authenticated user to create or modify accounts with arbitrary roles. The product uses a rolling release model, so no specific version numbers for affected or fixed releases are available [1].

Exploitation

An attacker needs network access to the application and any valid user account (or registration capability). The exploit involves sending a POST or PUT request to /user with a crafted payload that includes a role=admin parameter. A published proof of concept demonstrates the exact HTTP request [1]. No special position beyond remote network access is required.

Impact

Successful exploitation leads to privilege escalation — the attacker can assign themselves or others the administrative role, resulting in full account takeover and unauthorized access to all administrative functions. The CIA impact is primarily a compromise of integrity and availability, as the attacker gains complete control over user management and application settings [1].

Mitigation

No official patch exists as of the publication date (2026-05-25); the vendor did not respond to disclosure. Rolling release means users must rely on updates from the project source. Recommended workarounds include enforcing authorization middleware on all /user routes, removing role from the model's $fillable array, and implementing Laravel Policies for user creation and update operations [1].