CodeAstro QR Attendance EUVD-2026-83782

Requires an authenticated session against the CodeAstro QR Code Attendance Management System 1.0 web interface and the ability to reach the UserController Save action (the user create/edit save flow). The exploit works by supplying an attacker-chosen role_id in that request; no user interaction from a victim is needed (UI:N) and it is exploitable remotely over the network (AV:N, AC:L). Limiting factors: an account/login on the target instance is needed (this is not unauthenticated), the vulnerability is confined to a single, obscure open-source PHP application at version 1.0, and impact is bounded to Low across confidentiality/integrity/availability per the vendor vector.

This is a modest-risk authenticated privilege-escalation issue that the raw numbers already reflect. The vendor CVSS 4.0 base of 5.1 (medium) uses PR:H with only Low impacts across VC/VI/VA and subsequent-system metrics, and SSVC exploit maturity is 'Proof-of-Concept' (E:P). A public POC exists (GitHub Witiers/CVEs issue #4) but there is NO CISA KEV listing and NO EPSS score in the provided data, so exploitation status is 'publicly available exploit code exists' - not active exploitation. The one internal tension is the privilege metric: the flaw IS privilege escalation via manipulating role_id in a user-save routine, so the attacker is typically a lower-privileged authenticated user rather than a high-privileged one; I assess PR:L rather than the vendor's PR:H, which if anything slightly raises the technical severity but does not change the medium tier. Combined with a rare, hobby-grade product footprint, this is a low-priority issue for most defenders: real but not urgent, driven by POC availability rather than any evidence of widespread or automated exploitation.

An authenticated user of the attendance system submits a crafted request to the UserController Save endpoint including a role_id value pointing to a higher-privileged role (e.g. admin). Because the Save function applies the supplied role_id without an authorization check, the account is elevated and the attacker gains administrative control. A public proof-of-concept for this parameter manipulation is available on GitHub.