CVE-2026-109605: Improper Authorization in SourceCodester Simple Cafe Billing System

This vulnerability affects SourceCodester Simple Cafe Billing System version 1.0. The flaw is located in the Action::save_user function within the admin_class.php file of the User Management component. Improper authorization occurs due to manipulation of the 'Type' argument, enabling an attacker to perform unauthorized actions remotely without privileges. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code has been disclosed, increasing the risk of exploitation.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the user management functionality, potentially allowing unauthorized modifications or actions within the system. The impact is limited to the scope of the affected function and the degree of control granted by the improper authorization. The CVSS score indicates moderate risk with limited confidentiality, integrity, and availability impacts.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected component and monitor for exploitation attempts. Consider implementing additional access controls or input validation as a temporary mitigation.