Water Billing System CVE-2026-10236

Q: What is the CVSS score of CVE-2026-10236?

CVE-2026-10236 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33579 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-06-01 cna@vuldb.com

GHSA-34v4-r8c4-vxxc

Information Disclosure PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 09:37 vuln.today

DescriptionCVE.org

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unauthenticated remote attackers can create privileged administrator accounts in SourceCodester Water Billing Management System 1.0 by sending crafted requests to the User Management endpoint, bypassing all authorization controls. The researcher-published reference - titled 'Unauthenticated Admin Creation in PHP System' - confirms the practical impact exceeds the moderate CVSS score: full administrative takeover of the application is achievable without credentials. Publicly available exploit code exists (CVSS E:P), and no vendor patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based web system for managing water billing operations, distributed via SourceCodester. The vulnerable endpoint is /classes/Users.php?f=save, which handles user account creation and modification under the User Management component. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the server-side logic fails to verify whether the requesting party is authorized to assign elevated roles (such as administrator) before persisting the new user record. This is a server-side authorization gap - not an authentication bypass per se - where role assignment parameters in the HTTP request are accepted and processed without privilege validation. No CPE strings were provided, so affected version scope is limited to what is confirmed in the description: version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary recommended action is to immediately restrict access to the /classes/Users.php endpoint - particularly the f=save function - via web server configuration (e.g., nginx location block or Apache .htaccess) to limit requests to authenticated, privileged sessions only; note this is a compensating control, not a code fix, and could break legitimate admin workflows if not scoped correctly. Additionally, implement server-side role validation in the user save logic to verify the requesting session holds administrator privileges before processing any role assignment parameter. If the application is internet-facing, consider placing it behind a VPN or IP allowlist as an immediate risk reduction measure. Monitor the VulDB advisory at https://vuldb.com/vuln/367515 and the SourceCodester site for any forthcoming patch release.