CVE-2026-109605: SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::saveuser of the file adminclass.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue can be exploited remotely with low attack complexity and requires no privileges or user interaction. Exploitation involves manipulating the Type argument handled by Action::save_user in admin_class.php.
What is the likely impact if exploitation succeeds?
The available severity vector indicates low impact to confidentiality, integrity, and availability. The vulnerability is classified as improper authorization in the User Management component.
How urgent is remediation?
Remediation should be prioritized because a public exploit has been disclosed and the vulnerability is rated high severity. The supplied data does not identify a fixed version or a workaround.