Is there a public PoC exploit available for CVE-2026-9603?

Yes, a public proof-of-concept exploit is available for CVE-2026-9603. Prioritise patching immediately. EPSS: 0.0%.

eDoc Doctor Appointment System CVE-2026-9603

Q: What is the CVSS score of CVE-2026-9603?

CVE-2026-9603 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Missing Authorization (CWE-862)

2026-05-26 cna@vuldb.com

PHP Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 22:30 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session.php. The manipulation of the argument ID leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

Missing authorization in SourceCodester eDoc Doctor Appointment System 1.0 exposes the /admin/delete-session.php endpoint to unauthenticated remote attackers who can manipulate the ID parameter to delete arbitrary appointment sessions without any credential or privilege. The CVSS 4.0 vector confirms network-accessible, zero-complexity exploitation with no authentication required (PR:N), though impact is bounded to low integrity and availability degradation with no confidentiality loss. A publicly available exploit script (poc.sh) on GitHub confirms practical exploitability, though the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The affected application is a PHP-based medical appointment management system distributed by SourceCodester. CWE-862 (Missing Authorization) identifies the root cause: the delete-session.php script processes deletion requests against a backend database using a caller-supplied ID parameter without verifying whether the requesting party is authorized to perform that operation. This is a classic broken access control pattern - the admin-prefixed path implies restricted functionality, but no server-side enforcement of that restriction exists. The CVSS 4.0 supplemental tag E:P confirms proof-of-concept code is available, and the Tags field identifies PHP and Authentication Bypass as applicable descriptors. No CPE strings were provided in the source data, so affected product scope is limited to what the CVE description confirms: version 1.0.

Affected ProductsAI

SourceCodester eDoc Doctor Appointment System version 1.0 is the confirmed affected product, specifically the /admin/delete-session.php component. No CPE strings were included in the available intelligence data; affected version scope is drawn solely from the CVE description and VulDB submission (https://vuldb.com/vuln/365676). The vendor's distribution page is available at https://www.sourcecodester.com/, though no dedicated security advisory was identified there.

RemediationAI

No vendor-released patch has been identified at time of analysis. Given that SourceCodester applications are typically freeware/demo-grade with infrequent security maintenance, a formal release may not be forthcoming promptly. The definitive fix requires adding a server-side authorization check to /admin/delete-session.php that validates both the authenticity of the requestor's session and their role/permission to perform deletions before executing any database operation. As a compensating control, restrict network access to the /admin/ directory via web server configuration (e.g., Apache .htaccess IP allowlisting or nginx deny rules) to trusted administrative IP ranges only - this trades operational flexibility for meaningful attack surface reduction. If the application is not production-critical, taking it offline until patched is the lowest-risk option. The public exploit advisory is documented at https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9603-Missing-Authorization/Advisory.md.