Simple Cafe Billing System CVE-2026-109605

Exploitation requires a network-reachable instance of SourceCodester Simple Cafe Billing System 1.0 exposing the User Management functionality (the save_user action of admin_class.php). The specific prerequisite is the ability to submit the 'Type' parameter to this endpoint; because the CVSS vector is PR:N/UI:N, no authentication or user interaction is needed, so the improper-authorization check can be bypassed against a default deployment by manipulating the account Type value. The primary limiting factors are not configuration-based but exposure-based: the target must be internet- or network-accessible, and the product's extremely narrow deployment footprint (a SourceCodester demo/educational application) sharply limits the population of realistically exploitable systems.

This is a medium-severity (CVSS 4.0 base 5.5), network-exploitable improper-authorization flaw (CWE-285) in SourceCodester Simple Cafe Billing System 1.0. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation with no user interaction, which argues for easy triggering; however, all impact metrics are only Low (VC:L/VI:L/VA:L) and scope is unchanged (SC/SI/SA:N), capping real-world severity. Publicly available exploit code exists (POC flagged, VulDB E:P / 'proof-of-concept'), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. The dominant risk-limiting factor is deployment footprint: this is a SourceCodester hobby/educational PHP application with negligible enterprise presence, so despite the easy-to-exploit unauthenticated vector this is a low real-world priority rather than a high-urgency issue. The exploit reference ('billing-preauth-admin') implies pre-authentication creation/elevation of an admin-type user, which would be higher-impact than the vendor's Low ratings suggest - this tension between the low CVSS impact metrics and a pre-auth-admin exploit title should be verified against the actual exploit.

A remote, unauthenticated attacker sends a crafted request to the save_user action in admin_class.php and manipulates the 'Type' argument to assign themselves an elevated (e.g., administrator) account type, bypassing authorization checks. Public exploit code is available (referenced at tracexlabs.com as a pre-auth admin exploit), lowering the skill required. Given AV:N/AC:L/PR:N/UI:N, the request can be issued directly over the network against an exposed instance with no prior access or victim interaction.