CVE-2026-109605CWE-266CWE-285

CVE-2026-109605

High · published October 13, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00474 · 40.0th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-10-13T20:17Z
References (7)
https://tracexlabs.com/releases/billing-preauth-admin.html · [email protected]https://vuldb.com/cve/CVE-2026-109605 · [email protected]https://vuldb.com/submit/1000551 · [email protected]https://vuldb.com/vuln/417228 · [email protected]https://vuldb.com/vuln/417228/cti · [email protected]https://www.sourcecodester.com/ · [email protected]https://tracexlabs.com/releases/billing-preauth-admin.html · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 13 OCT 15:45Z
    SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
    cvelistv5
  • 13 OCT 15:45Z
    SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
    cvelistv5