CVE-2026-19345 Details
Description
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.
A vulnerability exists in Code-Projects Task Management System version 1.0, specifically in the file '/user/UpdateTaskStatus.php'. This issue arises from a missing authorization check for the 'task_id' and 'val' parameters, allowing remote attackers to unauthenticatedly change the status of tasks. The vulnerability has been publicly disclosed.
To address this vulnerability, implement the following measures: 1. Immediately terminate script execution after an authentication failure. 2. Return an HTTP 401 or 403 response instead of using a redirect for access control. 3. Verify that the authenticated user is authorized to modify the requested task. 4. Validate the 'task_id' parameter as a positive integer. 5. Restrict the 'val' parameter to accepted status values such as 'pending', 'working', and 'completed'. 6. Use prepared statements for database operations to prevent SQL injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 9, 2026CISA-ADP
Assessed Aug 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/865529 | CISA-ADP | Issue TrackingPermission Required |
| https://code-projects.org/ | [email protected] | Not ApplicableVendor |
| https://github.com/littleRain1355/PHPissue/issues/4 | [email protected] | ExploitIssue TrackingRemedy |
| https://vuldb.com/cve/CVE-2026-19345 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/865529 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/387181 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/387181/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code-Projects Task Management System | TASK_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE.zip |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 14, 2026 | CVE Modified | CISA-ADP |
| Aug 9, 2026 | New CVE Received | [email protected] |