Food Waste Management CVE-2026-105171

Exploitation requires an authenticated low-privilege account on the application (PR:L), after which the attacker sends a remote request to the file admin/admin.php and manipulates the 'Name' argument processed by the Role Attribute Handler to bypass authorization controls. No user interaction is needed (UI:N) and no non-default configuration is indicated. The primary limiting factors are the mandatory prior authentication, the low technical impact (only partial confidentiality/integrity/availability per VC:L/VI:L/VA:L), and the product's negligible deployment footprint; multiple endpoints are reportedly affected, but all are gated behind the same authenticated access requirement.

This is a low-priority, low-severity issue despite being an 'authorization bypass,' and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with low impact across all three dimensions (VC:L/VI:L/VA:L) yields a base-equivalent score of only 2.1, and critically it carries PR:L - meaning exploitation requires the attacker to already hold at least a low-privilege authenticated account, which substantially caps real-world risk. Exploit maturity is marked E:P (Proof-of-Concept), and the description confirms a public exploit exists, so publicly available exploit code exists; however, this must NOT be conflated with active exploitation. There is no CISA KEV listing and no EPSS score provided in the input, so widespread opportunistic exploitation cannot be asserted. The product is a hobbyist GitHub food-waste-management project with no versioning and an unresponsive maintainer, so even though the flaw is network-reachable, its practical exposure is minimal. Note a minor terminology tension: the input Tag reads 'Authentication Bypass' while the description and CWE-285 both describe 'authorization bypass' (improper authorization of an already-authenticated user) - verify framing, but it does not change the low-risk conclusion.

A low-privileged authenticated user of the application sends a crafted request to admin/admin.php manipulating the 'Name' argument handled by the Role Attribute Handler, tampering with role/authorization attributes to access functionality they should not have. A public proof-of-concept has been disclosed, lowering the skill barrier, though the attacker must first possess a valid low-privilege account and the impact is limited to partial read/write/availability effects.