SourceCodester Inventory System CVE-2026-11519

Q: What is the CVSS score of CVE-2026-11519?

CVE-2026-11519 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35069 LOW

Improper Authorization (CWE-285)

2026-06-08 VulDB

GHSA-g3xx-jm74-8r8g

PHP Authentication Bypass

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 15:37 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 08, 2026 - 14:52 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Improper authorization in SourceCodester Inventory System 1.0 allows authenticated remote attackers to manipulate the ROLE parameter in the account creation API endpoint, bypassing role-based access controls to create or modify accounts with elevated privileges beyond what is authorized. The affected component is /Product_Inventory/api/users_handler.php, a PHP endpoint that fails to enforce server-side authorization on the ROLE argument during account creation. A publicly available proof-of-concept exploit exists (CVSS temporal E:P), lowering the barrier for opportunistic abuse. No patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based inventory management system developed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:*). The vulnerability resides in the Account Creation Handler at /Product_Inventory/api/users_handler.php. CWE-285 (Improper Authorization) indicates the server accepts and trusts a client-supplied ROLE value without verifying whether the requesting user is authorized to assign that role. This is a classic mass-assignment or parameter tampering pattern common in PHP applications that pass API input directly into database logic without whitelist validation or privilege-level checks on the submitted role. The wildcard version in the CPE string suggests the issue may span beyond the confirmed 1.0 release if the codebase has not been forked and patched upstream.

RemediationAI

No vendor-released patch has been identified at time of analysis; the remediation level in the CVSS temporal vector is marked RL:X (not defined). Until a patch is released by SourceCodester, the following compensating controls are recommended: restrict access to /Product_Inventory/api/users_handler.php via web server configuration (e.g., Apache .htaccess or nginx location block) to administrative IP ranges only, accepting the trade-off that legitimate remote admin account creation will be blocked. If the endpoint must remain accessible, implement server-side validation that ignores or rejects the client-supplied ROLE parameter and instead derives the maximum permissible role from the authenticated session's existing privilege level. Disable self-registration if enabled, as it widens the pool of attackers who can obtain the prerequisite low-privilege credential. Monitor /Product_Inventory/api/users_handler.php access logs for unexpected ROLE values or account creation spikes. VulDB advisory: https://vuldb.com/vuln/369139.