CVE-2026-108948: Dynamically-Determined Object Attributes in code-projects Online Reviewer System

This vulnerability affects the Online Reviewer System 1.0 by code-projects, specifically in the file /reviewer/system/system/admins/manage/users/btn_functions.php within the User Profile Update Handler component. The issue arises from the manipulation of the usertype_id argument, which leads to dynamically-determined object attributes. This flaw can be exploited remotely without requiring user interaction or elevated privileges beyond low-level privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. Public exploit information is available, but no official patch or fix has been disclosed.

An attacker with low privileges can remotely manipulate the usertype_id argument to influence object attributes dynamically. This could potentially lead to unauthorized actions or privilege escalation within the affected system. The vulnerability does not require user interaction and has a medium severity rating. No confirmed in-the-wild exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected component and applying any available compensating controls specific to user profile management.