CVE-2026-109605 Details
Description
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
An improper authorization vulnerability has been identified in SourceCodester Simple Cafe Billing System version 1.0. The issue arises in the User Management component, specifically within the Action::save_user function of the admin_class.php file. This vulnerability allows remote exploitation by manipulating the Type argument, leading to unauthorized actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://tracexlabs.com/releases/billing-preauth-admin.html | CISA-ADP | Content WallExploit |
| https://tracexlabs.com/releases/billing-preauth-admin.html | [email protected] | Content WallExploit |
| https://vuldb.com/cve/CVE-2026-109605 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1000551 | [email protected] | Permission Required |
| https://vuldb.com/vuln/417228 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417228/cti | [email protected] | AdvisoryPermission Required |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Simple Cafe Billing System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |