CVE-2026-108948 Details

A privilege escalation vulnerability has been identified in Code-Projects Online Reviewer System version 1.0. The issue resides in the User Profile Update Handler, specifically within the file '/reviewer/system/system/admins/manage/users/btn_functions.php'. The vulnerability allows low-privileged users to manipulate the 'usertype_id' parameter, enabling them to gain unauthorized administrative access. This exploitation can be performed remotely.

To address this vulnerability, enforce strict access controls on the 'btn_functions.php' endpoint to prevent non-admin users from accessing it. Implement authorization checks to verify that the user has the appropriate privileges before allowing any role modifications. Additionally, separate the user profile update feature from the user management feature to prevent unauthorized role changes.