Is there a public PoC exploit available for CVE-2026-13549?

Yes, a public proof-of-concept exploit is available for CVE-2026-13549. Prioritise patching immediately. EPSS: 0.3%.

CodeAstro CMS CVE-2026-13549

Q: What is the CVSS score of CVE-2026-13549?

CVE-2026-13549 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40051 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-29 VulDB

GHSA-6rh3-v235-fwm4

PHP Authentication Bypass Complaint Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable unauthenticated IDOR with no confidentiality impact; UI:R maps the CVSS 4.0 UI:P passive-interaction signal; scope unchanged as impact is confined to report records.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 09:18 vuln.today

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Authorization bypass in CodeAstro Complaint Management System 1.0 exposes the deletereport endpoint to unauthenticated arbitrary deletion of complaint reports and associated files. The deletereport function in application/controllers/Report.php accepts a caller-supplied report identifier without verifying ownership or authorization, enabling any remote user to delete any report by manipulating that identifier. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, indicating no confirmed widespread active exploitation.

Technical ContextAI

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), commonly called Insecure Direct Object Reference (IDOR). The application is a PHP-based complaint management system built by CodeAstro. The deletereport controller action in application/controllers/Report.php accepts a report ID as a user-supplied parameter and processes the deletion without confirming that the requester is the owner of - or is authorized to delete - the referenced record. This is a classic object-level access control failure: the application may authenticate users at a session level but fails to enforce per-resource authorization. The affected CPE is cpe:2.3:a:codeastro:complaint_management_system:*:*:*:*:*:*:*:*, covering the 1.0 release of this PHP application.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch availability is unconfirmed and should be monitored at https://codeastro.com/ and https://vuldb.com/vuln/374557. As an immediate compensating control, restrict access to the report deletion endpoint (the deletereport route in application/controllers/Report.php) at the web server or reverse proxy layer to authenticated, authorized roles only; blocking this route entirely for unauthenticated requests eliminates the attack surface with no functional loss for legitimate anonymous users. At the application level, inserting an ownership check - verifying that the session user owns the targeted report ID before executing deletion - is the correct permanent fix. If the application cannot be patched promptly, consider disabling the report deletion feature or taking the application off public-facing networks until a fix is available. The public POC at https://github.com/ashikmd0507/CVE/tree/main/Unauthenticated%20Arbitrary%20Report%20%26%20File%20Deletion can be used to verify whether a compensating control is effective.