CVE-2026-10236

HIGH

SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization

Title source: cna
STIX 2.1

Description

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References (6)

Core 6
Core References
Vdb Entry vdb-entry
VDB-367515 | SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization
https://vuldb.com/vuln/367515
Signature, Permissions Required signature permissions-required
VDB-367515 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367515/cti
Third Party Advisory third-party-advisory
CVE-2026-10236 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10236
Third Party Advisory third-party-advisory
Submit #823134 | SourceCodester Water Billing Management System in PHP/OOP Free Source Code 1.0 Authorization Bypass
https://vuldb.com/submit/823134

Scores

CVSS v3 7.3
EPSS 0.0037
EPSS Percentile 28.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (1)
SourceCodester/Water Billing Management System 1.0
Published Jun 01, 2026
Tracked Since Jun 01, 2026