CVE-2026-7091 Details

A vulnerability exists in Code-Projects Invoice System version 1.0, specifically within the User Management component. The issue arises from improper authorization in the '/user' endpoint, which can be accessed without admin privileges. This flaw allows users to create or modify accounts with administrative roles, leading to unauthorized access to admin functions. The vulnerability can be exploited remotely, and a public exploit is available.

It is recommended to enforce proper authorization checks on the '/user' routes, ensuring that only admin users can access them. Additionally, the application should validate or restrict the 'role' input to prevent unauthorized role assignments.