CVE-2026-11519

MEDIUM

SourceCodester Inventory System Account Creation users_handler.php improper authorization

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

References (5)

Core 5
Core References
Signature, Permissions Required signature permissions-required
VDB-369139 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369139/cti
Vdb Entry, Technical Description vdb-entry technical-description
VDB-369139 | SourceCodester Inventory System Account Creation users_handler.php improper authorization
https://vuldb.com/vuln/369139
Third Party Advisory third-party-advisory
CVE-2026-11519 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11519
Third Party Advisory third-party-advisory
Submit #836392 | SourceCodester Inventory System using PHP and MySQL Source Code 0 Authorization Bypass
https://vuldb.com/submit/836392

Scores

CVSS v3 6.3
EPSS 0.0026
EPSS Percentile 17.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (1)
SourceCodester/Inventory System 1.0
Published Jun 08, 2026
Tracked Since Jun 08, 2026