CVE-2026-10693: SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization
A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement and enforce server-side authorization checks on all administrative endpoints. Validate user roles and permissions for every admin action and reject requests that do not meet required privileges.
SourceCodester Online Boat Reservation System Administrative Endpoint authorization_enforcement = enforced (server-side role and permission checks) - Compensating control
Restrict access to administrative endpoints to trusted IP addresses or networks using firewall rules, ACLs, or require access via VPN. Block public internet access to admin interfaces and place them behind an authentication gateway or WAF until a permanent fix is applied.
- Compensating control
If immediate patching is not possible, disable or remove access to affected administrative endpoints or limit their functionality (read-only or maintenance mode) until proper authorization controls are implemented.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10693?
The severity of CVE-2026-10693 is rated as medium with a score of 6.3.
What components are affected by CVE-2026-10693?
CVE-2026-10693 affects the Administrative Endpoint component of SourceCodester Online Boat Reservation System 1.0.
What type of vulnerability is CVE-2026-10693?
CVE-2026-10693 is categorized as an improper authorization vulnerability.
How do I fix CVE-2026-10693?
To fix CVE-2026-10693, ensure that proper authorization checks are implemented for the Administrative Endpoint.
Can CVE-2026-10693 be exploited remotely?
Yes, CVE-2026-10693 can be exploited remotely due to improper authorization in the affected system.