CVE-2026-108972: Improper Authentication in SourceCodester Human Resource Management System

The vulnerability in SourceCodester Human Resource Management System 1.0 affects the Employee Endpoint component, specifically the session_start function in controller/employee.php. Improper handling and validation of the role, pfimg, and EmpId arguments allow attackers to bypass authentication mechanisms remotely. This improper authentication flaw could enable unauthorized access to the system. A public exploit exists, but there is no information about active exploitation in the wild or vendor-provided patches.

Successful exploitation allows an attacker to bypass authentication controls remotely, potentially gaining unauthorized access to employee-related functions within the Human Resource Management System. This could lead to unauthorized data access or manipulation. The CVSS score of 6.9 reflects a medium impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor patch or official fix information is provided, users should monitor for vendor updates and consider implementing compensating controls such as restricting access to the affected endpoint until a fix is available.