CVE-2026-71252 Details

A vulnerability exists in the Toner Management application within its admin state-changing handlers, specifically in add.php, edit.php, and delete.php files located under admin/toners, admin/toner-brands, admin/printers, and related subdirectories. These handlers performed database operations such as INSERT, UPDATE, and DELETE without requiring authentication or authorization. While access control was applied in listing views, it was absent in the state-changing operations, allowing unauthenticated remote attackers to directly invoke these handlers and manipulate application data. The vendor has since implemented a fix that requires an authenticated admin session before these handlers can be used.

Users are advised to update to the latest version of the Toner Management application, where this vulnerability has been addressed by requiring admin authentication for state-changing actions.