CVE-2026-5326
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability was identified in SourceCodester Leave Application System 1.0 in an unknown function of /index.php?page=manage_user within the User Information Handler component. Manipulation of the ID argument leads to authorization bypass, and the attack can be executed remotely. The exploit is publicly available and might be used.
Risk Assessment
An attacker can remotely bypass access controls and perform operations reserved for other users, potentially leading to unauthorized data changes.
Recommendation
Apply a fix as soon as possible or restrict access to the application (e.g., via authentication and network segmentation). Verify proper authorization checks for the ID argument in manage_user.
Other vulnerabilities in SourceCodester Leave Application System
See all- CVE-2026-5210High
SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.
- CVE-2026-5209Low
A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS