What is the CVSS score of EUVD-2026-16509?

EUVD-2026-16509 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16509?

Organizations using PHP using CodeIgniter framework. should be aware of notable risk from CVE-2026-33730, a IDOR vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate EUVD-2026-16509?

Within 30 days: Identify affected systems running PHP using CodeIgniter framework. and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP EUVD-2026-16509

| CVE-2026-33730 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-27 GitHub_M

PHP Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.4.2

EUVD ID Assigned

Mar 27, 2026 - 00:45 euvd

EUVD-2026-16509

Analysis Generated

Mar 27, 2026 - 00:45 vuln.today

CVE Published

Mar 27, 2026 - 00:30 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the employee_id parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.

AnalysisAI

OpenSourcePOS versions prior to 3.4.2 contain an Insecure Direct Object Reference (IDOR) vulnerability allowing authenticated low-privileged users to modify password change settings for arbitrary users, including administrators, by manipulating the employee_id parameter without authorization checks. The vulnerability affects the web-based PHP/CodeIgniter point-of-sale application and enables account takeover of higher-privileged accounts. No public exploit code has been identified at the time of analysis, though the fix involves adding object-level authorization validation to the affected endpoint.

Technical ContextAI

OpenSourcePOS (cpe:2.3:a:opensourcepos:opensourcepos:*:*:*:*:*:*:*:*) is a web-based point of sale system built on the CodeIgniter PHP framework. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and stems from missing object-level authorization checks in the password change functionality. The application fails to verify that the authenticated user owns or has permission to modify the employee_id being accessed, a fundamental authorization control gap. The affected parameter (employee_id) is directly mappable to database records without intermediate permission validation, enabling horizontal privilege escalation where a low-privileged user can enumerate and modify records belonging to other users.

RemediationAI

Upgrade OpenSourcePOS to version 3.4.2 or later, which includes object-level authorization checks to validate user ownership of employee_id parameters (see GitHub advisory at https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch and upstream commit ee4d44ed396097d6010c5490ab4fd7cfea694624). As an interim mitigation for organizations unable to patch immediately, restrict network access to the password change endpoint to administrative networks, enforce strong password policies to limit blast radius if credentials are compromised, audit access logs for suspicious employee_id parameter manipulation, and implement additional authentication factors (multi-factor authentication) for administrative accounts. Consider deploying a web application firewall rule to detect and block repeated attempts to access employee_id values that do not match the authenticated user's own ID.