Is there a public PoC exploit available for CVE-2026-5326?

Yes, a public proof-of-concept exploit is available for CVE-2026-5326. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5326

Q: What is the CVSS score of CVE-2026-5326?

CVE-2026-5326 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18188 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-02 VulDB

GHSA-x3j8-jq3m-7644

PHP Authentication Bypass Leave Application System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 11:00 euvd

EUVD-2026-18188

Analysis Generated

Apr 02, 2026 - 11:00 vuln.today

CVE Published

Apr 02, 2026 - 10:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote authentication bypass in SourceCodester Leave Application System 1.0 allows unauthenticated attackers to access user information via insecure direct object reference (IDOR) in the /index.php?page=manage_user endpoint by manipulating the ID parameter. The vulnerability has a publicly available exploit and CVSS 5.3 (low-moderate confidentiality impact), though actual risk depends on the sensitivity of exposed user data and system context.

Technical ContextAI

The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of access control flaw where user-supplied input directly controls object references without proper authorization checks. The affected component is the User Information Handler in a PHP-based leave management application (CPE: cpe:2.3:a:sourcecodester:leave_application_system:*:*:*:*:*:*:*:*). The attack exploits insecure direct object reference (IDOR) logic in the index.php routing mechanism, where the 'page=manage_user' parameter processes an unvalidated ID argument. An attacker can enumerate or brute-force ID values to retrieve user records without authentication, bypassing access control that should restrict data visibility to authorized personnel only.

RemediationAI

Implement immediate input validation and authorization checks in the User Information Handler component: validate that the ID parameter corresponds to a user record the authenticated session is permitted to access, enforce role-based access control (RBAC) before returning user data, and regenerate or invalidate any session tokens if prior unauthorized access is suspected. Request a patched version from SourceCodester at https://www.sourcecodester.com/ or apply custom access control logic to /index.php?page=manage_user if a vendor patch is unavailable. As a temporary workaround, restrict network access to the application via firewall rules or require VPN authentication until patches are applied. Review server logs for exploitation attempts targeting the manage_user endpoint with varied ID parameters.