Barangay Profiling System CVE-2026-78142

Exploitation requires a valid authenticated session with at least low-privileged access to the Barangay Resident Profiling Management System (CVSS PR:L) - unauthenticated network attackers cannot exploit this vulnerability. The vulnerable endpoint is specifically /archived_records.php and its Restore and Delete actions, which accept a resident_id parameter without server-side ownership or role validation. Network access to the web server is required (AV:N). No non-default application configuration is necessary beyond possession of an active user account. The primary limiting factor is the requirement for a valid low-privileged credential, which restricts exploitation to registered insiders, compromised accounts, or attackers who have obtained credentials through a separate initial access step.

The CVSS 4.0 score of 2.1 is notably low, with the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L reflecting network-accessible exploitation that nonetheless requires a low-privileged authenticated account, with only limited confidentiality, integrity, and availability impact and no scope change to other systems. The E:P supplemental metric is confirmed by a public GitHub proof-of-concept, which modestly increases the likelihood of opportunistic abuse. No EPSS score was supplied in the input data, leaving exploitation probability quantification as an unknown signal. The vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation campaigns at time of analysis. Overall risk is low: exploitation is gated behind authenticated access, impact is bounded to individual resident records, and the product has a limited real-world production footprint. The primary realistic threat is insider abuse or post-credential-compromise lateral action within a civic government IT environment.

An authenticated low-privileged user submits HTTP requests to /archived_records.php, incrementing or fuzzing the resident_id parameter to enumerate archived records belonging to other residents. Using the publicly available proof-of-concept at https://gist.github.com/c4ttr4ck/190b532b4b239fdc8f6fb72d89bde2c8, the attacker identifies valid record IDs and issues unauthorized Restore or Delete operations against those records without requiring any additional privilege escalation.