Inventory Management System CVE-2026-13568

The User Registration Endpoint at /api/users_handler.php must be network-reachable without prior authentication, consistent with PR:N in the CVSS 4.0 vector. No special server configuration, enabled feature flag, or non-default setting is required beyond the PHP application being deployed and the endpoint being accessible - default deployments of SourceCodester Inventory Management System 1.0 appear to expose this endpoint without access controls. Exploitation is meaningfully limited by the niche, educational-script nature of this product: it is unlikely to be found in enterprise environments. The attacker must be able to send HTTP POST requests to the target host on whatever port the web server is bound to.

The CVSS 4.0 base score of 5.5 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-complexity, unauthenticated, network-reachable attack requiring no user interaction - a favorable attack profile for an adversary. Impact is assessed as low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), though the privilege escalation foothold could enable broader secondary access depending on what administrative roles expose in the application. The exploit maturity modifier E:P confirms a public proof-of-concept exists, meaningfully increasing opportunistic risk. No CISA KEV listing is present and no EPSS score was provided, so widespread active exploitation is not confirmed - the absence of KEV and EPSS data is a gap that should be noted rather than treated as absence of exploitation. The product's niche deployment footprint as an educational PHP script significantly limits the realistic population of vulnerable targets. Real-world risk is low-to-moderate for the rare production deployments of this software.

An unauthenticated attacker sends a crafted HTTP POST request to /api/users_handler.php with the role parameter set to an elevated value such as 'admin' or an integer representing administrative privilege. The server processes the registration without validating or overriding the role assignment, creating an account with full administrative access. The attacker then authenticates with these credentials to access restricted inventory data, modify records, or pivot further within the application - a public proof-of-concept lowers the expertise required to execute this sequence.