SourceCodester Inventory System CVE-2026-11519

Exploitation requires the attacker to hold a valid low-privilege authenticated session (CVSS PR:L) on the target Inventory System instance - unauthenticated remote exploitation is not indicated by the available data. The vulnerable endpoint /Product_Inventory/api/users_handler.php must be network-accessible (AV:N), which is the default deployment posture for a web-based inventory system. The attack is limited to: possession of any valid credential (self-registered or otherwise), direct network access to the API endpoint, and the application running PHP with the users_handler.php file present. No special non-default configuration is required beyond a standard installation. The key limiting factor is the authentication prerequisite - attackers without any valid account cannot directly exploit this without first obtaining credentials through a separate vector such as default credentials, phishing, or a companion unauthenticated vulnerability.

The CVSS base score of 6.3 (Medium) reflects a network-accessible attack (AV:N) with low complexity (AC:L), but critically requires low-level authentication (PR:L) - an attacker must hold a valid account before exploiting this flaw. The CIA triad impact is uniformly low (C:L/I:L/A:L), suggesting the immediate blast radius per exploitation is contained. However, the integrity impact combined with unauthorized privilege escalation in an account creation context can be a stepping stone to full administrative compromise if a newly created high-privilege account is then used for further attacks. The temporal vector includes E:P (proof-of-concept public) and RL:X (no remediation level defined), indicating no patch is available and exploit code is accessible. RC:R (reasonable confidence) reflects VulDB as sole reporter without vendor confirmation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. No KEV listing confirms active exploitation. The real-world risk is moderate: the low-privilege prerequisite limits opportunistic internet-wide scanning, but any authenticated user - including self-registered accounts if public registration is enabled - could exploit this to escalate role assignments.

An attacker who has registered or obtained a low-privilege account on a publicly accessible Inventory System instance crafts a POST request to /Product_Inventory/api/users_handler.php, supplying an elevated ROLE value (e.g., administrator) in the request body. Because the server does not validate whether the requesting user's session is authorized to assign that role, the new account is created with administrative privileges. A publicly released proof-of-concept (E:P) demonstrates this technique, meaning the attacker does not need to independently discover or develop the exploit.