CVE-2026-11519: SourceCodester Inventory System Account Creation users_handler.php improper authorization
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ProductInventory/api/usershandler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
/Product_Inventory/api/users_handler.phpfrom your environment.If self-service account creation is not required, remove or disable the users_handler.php Account Creation Handler endpoint to eliminate the vulnerable code until a proper code fix is available.
- Configuration
Do not accept or trust a client-supplied ROLE parameter. Enforce role assignment and any role changes only on the server side after proper authorization checks; reject or ignore ROLE input from unauthenticated or non-privileged requests.
SourceCodester Inventory System - Account Creation Handler (/Product_Inventory/api/users_handler.php) client_role_parameter_handling = ignore/validate_only_server_side - Compensating control
Restrict remote access to /Product_Inventory/api/users_handler.php using network controls (firewall, ACLs) or a web application firewall to allow only trusted IPs or internal networks until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11519?
The severity of CVE-2026-11519 is medium with a score of 6.3 on the CVSS scale.
What components are affected by CVE-2026-11519?
CVE-2026-11519 affects the Account Creation Handler in the /Product_Inventory/api/users_handler.php file of SourceCodester Inventory System.
How does CVE-2026-11519 impact the SourceCodester Inventory System?
CVE-2026-11519 allows improper authorization due to manipulation of the ROLE argument during the account creation process.
How do I fix CVE-2026-11519?
To fix CVE-2026-11519, ensure that proper validation and authorization checks are implemented for the ROLE argument in the users_handler.php file.
What is the potential risk of exploiting CVE-2026-11519?
Exploiting CVE-2026-11519 could allow unauthorized users to gain access to restricted functionalities within the SourceCodester Inventory System.