CVE-2026-94048: CodeAstro QR Code Attendance Management System UserController.php save privileges management
A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges (PR:H) to manipulate the role_id argument in the Save function. Exploitation can be performed remotely and does not require user interaction.
What is the likely impact of successful exploitation?
The issue causes improper privilege management and may allow changes to user role assignments. The reported impact includes low confidentiality, integrity, and availability effects, with scope changed (S:C).
Is public exploit code available?
Yes. The exploit is reported as public and may be used, increasing the likelihood of exploitation where an attacker has the required privileges.
Which component should be reviewed for exposure?
Review CodeAstro QR Code Attendance Management System version 1.0, specifically app/Controllers/UserController.php and its Save function. Check whether role_id can be supplied or altered during user save operations.