CVE-2025-56274 describes an incorrect access control vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerability permits users with low privileges to escalate their session privileges to that of an administrator, allowing unauthorized sensitive operations including the creation of new user accounts. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. There is no information about available patches or vendor advisories addressing this issue.

Exploitation of this vulnerability could lead to unauthorized administrative access, allowing attackers to add new users and potentially manipulate the system. This compromises confidentiality and integrity of the system data. Availability impact is not indicated. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for suspicious activity related to session management and user account creation.