The vulnerability CVE-2026-10255 affects SourceCodester Pharmacy Sales and Inventory System 1.0. It arises from improper access control in the sell_statement function of the ShowForm.php controller. This weakness enables remote attackers to bypass intended access restrictions, potentially allowing unauthorized actions related to sales statements. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. There is no vendor-provided patch or official remediation level documented at this time.

An attacker can remotely exploit this vulnerability to bypass access controls in the affected function, potentially leading to unauthorized access or manipulation of sales statement data within the system. The impact on confidentiality is low, and there is no direct indication of integrity or availability impact. Exploitation does not require privileges or user interaction. The vulnerability could be leveraged to perform unauthorized operations remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected application and reviewing access control configurations to limit exposure.