TOKO-ONLINE-ROTI CVE-2026-15909

Q: What is the CVSS score of CVE-2026-15909?

CVE-2026-15909 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44839 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-16 VulDB

GHSA-f4xv-85hg-mw5r

PHP Authentication Bypass Toko Online Roti Rafymrx

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible IDOR requiring a low-privilege authenticated session (PR:L); partial C and I impacts for cross-customer data access and modification; no realistic availability impact from parameter substitution alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 01:13 vuln.today

DescriptionCVE.org

A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd_cs leads to authorization bypass. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authorization bypass in RafyMrX TOKO-ONLINE-ROTI allows a low-privileged remote attacker to manipulate the kd_cs parameter in proses/add.php to access or modify data belonging to other customers, a classic CWE-639 Insecure Direct Object Reference pattern. The application up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is confirmed affected, with no vendor patch available after the vendor failed to respond to responsible disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity of parameter manipulation makes this trivially reproducible with standard HTTP tooling.

Technical ContextAI

TOKO-ONLINE-ROTI is a PHP-based online bakery/bread-shop web application developed by RafyMrX and identified via CPE cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of IDOR (Insecure Direct Object Reference), where the application accepts a user-supplied customer identifier - the kd_cs argument - in proses/add.php without verifying that the requesting user is authorized to act on the referenced customer record. The application trusts the client-controlled key rather than binding operations to the server-side session identity. This is a common PHP anti-pattern where row-level access control is absent and the object reference is exposed directly in the HTTP request parameter.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure. Immediate remediation requires adding server-side authorization enforcement in proses/add.php that validates the submitted kd_cs value against the authenticated session's user identity before processing any add operation - the fix must reject any request where the customer key does not belong to the authenticated user. As a compensating control, operators can restrict access to proses/add.php via web server configuration (e.g., require a specific role cookie or session attribute validated server-side) to reduce the exploitable surface. Replace user-supplied kd_cs parameter lookups with session-bound customer identifiers that cannot be enumerated or substituted by the client; this eliminates the IDOR surface entirely. Monitoring web access logs for anomalous or enumerated kd_cs parameter sequences can help detect exploitation attempts in the interim. See https://vuldb.com/vuln/379368 for the original report.