SourceCodester Inventory System 1.0 contains an improper authorization vulnerability in the Account Creation Handler component, specifically in the /Product_Inventory/api/users_handler.php file. Manipulating the ROLE argument allows an attacker to bypass authorization controls remotely without requiring privileges or user interaction. The vulnerability has been publicly disclosed with an exploit available, but no official patch or remediation level has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls related to user roles, potentially enabling unauthorized actions within the inventory system. The impact is rated medium severity with a CVSS score of 5.3. There is no evidence of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, organizations should monitor for updates from SourceCodester. Until a patch is available, consider restricting access to the affected API endpoint and implementing additional access controls to limit exposure.