CVE-2026-11519
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
Risk Assessment
The risk involves unauthorized creation of accounts with elevated privileges, potentially leading to full system compromise.
Recommendation
Apply patches from the vendor immediately or implement custom access control mechanisms for this file.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-11520Low
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
- CVE-2026-11518Medium
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.