CVE-2026-5330 Details

A broken access control vulnerability has been identified in SourceCodester Gaatitrack Courier Management System version 1.0. The issue resides in the User Delete Handler component, specifically within the ajax.php file, where the delete_user action is processed. This vulnerability allows unauthenticated users to delete any registered user, including administrators, by manipulating the user ID parameter. The deletion is executed without any authentication checks, leading to unauthorized removal of user accounts and potential disruption of service.

Implement authentication checks in ajax.php to ensure that only logged-in users can access the delete_user action. Additionally, establish role-based access controls to verify that the user has the necessary administrative privileges before allowing deletion. Consider using soft deletion methods to prevent permanent loss of data.