CVE-2026-90565: Rizwan17 inventory-management-system dashboard.php access control
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. An attacker can manipulate the userid argument handled by dashboard.php to bypass intended access controls.
Is public exploitation a concern?
Yes. An exploit has been released publicly and may be used in attacks, which raises the likelihood of opportunistic exploitation against reachable deployments.
Are fixed or affected release versions available?
No. The project uses a rolling-release delivery model, and no affected or updated version details are available.
What should teams do if no patch is available?
Restrict remote access to the application, especially access to dashboard.php, to trusted users or networks where possible. Review and enforce server-side authorization for requests involving the userid argument.
Has the project acknowledged or resolved the report?
The project was notified early through an issue report but had not responded at the time of the available information.