CVE-2026-90856 Details

A vulnerability allowing unauthorized admin account creation has been identified in SourceCodester College Notes Gallery Management System version 1.0. The issue resides in the `signup.php` file within the registration flow component. The vulnerability arises because the application fails to validate the `role` parameter on the server side, allowing attackers to manipulate the request and assign themselves administrative privileges. This exploitation can be done remotely, and the created admin accounts bypass normal authorization processes.

To address this vulnerability, implement a server-side allowlist for the `role` parameter, ensuring that only authorized roles can be assigned. Additionally, require administrative approval for elevated roles and validate all sensitive fields on the server. Finally, add authorization checks before processing privileged actions.