CVE-2026-90856CWE-266CWE-269privilege-escalation

CVE-2026-90856

High · published September 15, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00495 · 41.6th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2026-09-15T07:17Z
References (6)
https://github.com/Andyov0/cve/issues/4 · [email protected]https://vuldb.com/cve/CVE-2026-90856 · [email protected]https://vuldb.com/submit/927252 · [email protected]https://vuldb.com/vuln/403413 · [email protected]https://vuldb.com/vuln/403413/cti · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 03:00Z
    SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management
    cvelistv5