This vulnerability in SourceCodester Inventory System 1.0 arises from improper authorization controls in the Account Creation Handler component, specifically in the /Product_Inventory/api/users_handler.php file. Manipulating the ROLE argument allows an attacker to bypass authorization restrictions remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although an exploit has been publicly released, no official fix or patch is currently documented. The vendor has not provided remediation instructions or advisories, and the product is not a cloud service, so remediation depends on vendor or user action.

An attacker can remotely manipulate the ROLE argument to bypass authorization controls, potentially gaining unauthorized access or privileges within the Inventory System. This could lead to unauthorized account creation or privilege escalation. The availability of a public exploit increases the likelihood of exploitation. However, the impact is rated medium severity, reflecting limited scope or complexity of the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. In the meantime, restricting access to the affected API endpoint and implementing additional access controls or input validation may reduce risk.