CVE-2026-105171: Authorization Bypass in kishor-23 food-waste-management-system

This vulnerability in the kishor-23 food-waste-management-system involves an authorization bypass via manipulation of the 'Name' argument in the Role Attribute Handler component located in admin/admin.php. The flaw allows remote attackers to bypass authorization checks, potentially gaining unauthorized access to restricted functionality. The product lacks versioning, preventing identification of specific affected or unaffected versions. The issue was reported early to the project, but no vendor response or patch has been issued. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.

Successful exploitation of this vulnerability could allow an attacker with low privileges to bypass authorization controls remotely, potentially accessing restricted administrative functions or data. The exact impact depends on the privileges gained through the bypass. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor for updates from the project. Until a fix is released, restricting access to the affected admin endpoints and applying compensating controls to limit exposure may reduce risk.