TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

published 2025-03-18 19 mo ago modified 2026-06-17 4 mo ago also GHSA-gg2f-r4jh-vpmh , EUVD-2024-54210

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits: 0; none known

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.

Patch / fix

fixed in 1

packagist tastyigniter/tastyigniter 4.0.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 19 mo ago (2025-03-25)

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

medium.com https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	tastyigniter/tastyigniter	<4.0.0	4.0.0

Classification

Weakness

CWE-284 Improper Access Control

References

medium.com /@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74
web, exploit
github.com /tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php
web, product
nvd.nist.gov /vuln/detail/CVE-2024-44313
advisory
github.com /tastyigniter/TastyIgniter
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary