Restaurant Management System CVE-2026-109114

Exploitation requires network reachability to the application's User/login.php endpoint (the Login Form component) and the ability to supply the email and passwd parameters; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirement, and no user interaction are needed, so default deployments reachable over the network are exposed. The practical limiting factor is not configuration but deployment scope: the product is an individual GitHub project with no versioned releases (rolling delivery pinned only to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) and essentially no production installations; impact is also bounded to Low confidentiality/integrity/availability with no scope change, so a successful bypass yields partial unauthorized access rather than full system takeover.

Real-world risk is moderate-to-low despite the improper-authentication class (CWE-287). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms a remotely reachable, unauthenticated, low-complexity flaw in the login form - attractive on paper - but every impact metric is only Low (VC:L/VI:L/VA:L, SC/SI/SA:N), yielding a medium 6.9 base score rather than critical, which signals partial rather than full account/system compromise. The exploit maturity is E:P (Proof-of-Concept), consistent with the publicly disclosed POC, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of widespread or automated active exploitation - treat this as 'publicly available exploit code exists', not active exploitation. The dominant risk-limiting factor is the target itself: an obscure student/hobby GitHub project (AdithyaYelloju/Restaurant-Management-System) with negligible production footprint. No SSVC decision data or EPSS was supplied - STATED EXPLICITLY as missing - so automatability and real-world exploitation probability cannot be quantified. Net: a genuine, easily-reproducible auth flaw of academic interest, but low operational priority for most organizations given minimal deployment.

A remote, unauthenticated attacker sends a crafted request to User/login.php manipulating the email/passwd parameters to bypass the authentication check and obtain an application session without valid credentials. A public proof-of-concept is referenced via the project's GitHub issue tracker (issue #11), lowering the skill barrier. Because CVSS complexity is Low and no user interaction is needed, exploitation is straightforward wherever the application is reachable.