CVE-2026-13549 is an authorization bypass vulnerability affecting the deletereport function in the Report.php file of CodeAstro Complaint Management System version 1.0. The vulnerability allows remote attackers to bypass authorization checks and potentially delete reports without proper permissions. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or mitigation has been published by the vendor, and the exploit code is publicly available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass authorization controls and delete complaint reports within the system. This could lead to unauthorized data modification or loss of complaint records. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality and monitor for suspicious activity related to report deletion. Avoid exposing the vulnerable endpoint to untrusted networks if possible.