Food Waste Management System EUVD-2026-92146

Exploitation targets the Admin Signup component specifically via the file admin/signup.php, by manipulating the 'sign' argument to bypass the missing authentication check. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special configuration, and no user interaction are required, so a default deployment with the admin signup endpoint network-reachable is exploitable. The primary limiting factor is exposure and deployment scale: the affected instance must be internet- or network-accessible to the attacker, and the product is an obscure open-source project that is rarely deployed in production. No patched release is available because the project uses continuous/rolling delivery and has not responded to the report.

Signals are consistent but point to modest real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated flaw, which normally elevates concern, yet the vendor-assigned impact is uniformly low (VC:L/VI:L/VA:L) and the base score is only 5.5 (Medium). The E:P (Proof-of-Concept) exploit maturity and the explicit statement that 'the exploit has been made available to the public' confirm POC availability, but this is NOT the same as active exploitation - the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be asserted. The most important mitigating signal is target obscurity: kishor-23/food-waste-management-system is an individual-developer GitHub project with no known enterprise footprint, so despite the easy-to-exploit profile this is a low-priority issue for most defenders. Note a tension worth flagging: the flaw is a missing-authentication weakness on an Admin Signup endpoint (CWE-287), which in principle could permit unauthorized administrative account creation and justify higher integrity impact than the vendor's VI:L - verify actual admin privilege gained before downgrading on impact alone.

A remote, unauthenticated attacker sends a crafted request to admin/signup.php, manipulating the 'sign' parameter to bypass the authentication control guarding the Admin Signup component. Because a public proof-of-concept exists, an attacker can reproduce the bypass with little effort to register or escalate to an administrative account on an exposed instance. No user interaction or prior credentials are required.