Improper Authorization Vulnerability in Sushmi-pal Invoice System
CVE-2026-9409

5.3MEDIUM

Key Information:

Vendor

Sushmi-pal

Status
Invoice-system
Vendor
CVE Published:
25 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9409?

An improper authorization flaw exists in the Sushmi-pal Invoice System affecting versions up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability specifically impacts the User Management Handler component, where manipulation of the 'role' argument can lead to unauthorized access. The vulnerability allows for remote exploitation, providing adversaries the ability to gain elevated permissions unlawfully. Despite the vendor being notified of the disclosure, there has been no response or updates regarding remediation, emphasizing the urgency for users to take protective measures.

Affected Version(s)

Invoice-System a0a3faa16dee2621b231ae227333f5761607283b

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9409 - Proof of Concept

References

https://vuldb.com/vuln/365390
vdb-entrytechnical-description
https://vuldb.com/vuln/365390/cti
signaturepermissions-required
https://vuldb.com/submit/813605
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

c4ttr4ck (VulDB User)
VulDB CNA Team
.