Inventory Management System EUVD-2026-40088

Q: What is the CVSS score of EUVD-2026-40088?

EUVD-2026-40088 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-13568 MEDIUM

Improper Access Control (CWE-284)

2026-06-29 VulDB

GHSA-w68f-j8vg-r852

PHP Authentication Bypass Inventory Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Unauthenticated network-accessible registration endpoint; role tampering yields limited privilege gain with no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:28 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Privilege escalation via role parameter manipulation in SourceCodester Inventory Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during user registration. The vulnerability resides in /api/users_handler.php, where the application fails to enforce server-side restrictions on the role argument at the User Registration Endpoint, enabling account creation with admin-level privileges. A public proof-of-concept exploit is available, lowering the skill bar for abuse against any exposed instance; no CISA KEV listing exists, so confirmed active exploitation in the wild has not been established.

Technical ContextAI

The affected product is SourceCodester Inventory Management System 1.0 (CPE: cpe:2.3:a:sourcecodester:inventory_management_system:*:*:*:*:*:*:*:*), a PHP-based web application distributed as a free educational script via sourcecodester.com. CWE-284 (Improper Access Control) is the root cause: the /api/users_handler.php endpoint accepts a user-controlled role parameter during registration without server-side validation, authorization enforcement, or role whitelisting. This is a classic parameter-tampering or mass-assignment pattern common in PHP applications where API inputs are passed directly to data models without sanitization. The CVSS 4.0 vector (PR:N) confirms the registration endpoint is publicly accessible without prior authentication, making the attack entirely unauthenticated.

RemediationAI

No vendor-released patch has been identified at time of analysis - SourceCodester does not publish a formal security advisory or tracked release for this issue. As an immediate compensating control, restrict public access to /api/users_handler.php via web server ACLs (e.g., Apache .htaccess deny directives or nginx location blocks) or upstream firewall rules, particularly if external self-registration is not a required feature. Developers should implement server-side role validation by whitelisting only permitted values (e.g., enforcing a hardcoded default role of 'user' regardless of input) and ensuring role assignment is performed exclusively by already-authenticated administrators - never from registration-time user-supplied input. Disabling the self-registration endpoint entirely is the most effective mitigation if the feature is nonessential. The VulDB entry at https://vuldb.com/vuln/374576 and its CTI feed at https://vuldb.com/vuln/374576/cti provide additional technical detail for defenders.