CVE-2026-13568 is an improper access control vulnerability in SourceCodester Inventory Management System 1.0. The issue resides in the /api/users_handler.php file within the User Registration Endpoint, where manipulation of the 'role' parameter can bypass intended access controls. This vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation could allow an attacker to escalate privileges or gain unauthorized access by manipulating user roles during registration. This may lead to unauthorized actions within the inventory management system. The medium CVSS score reflects limited but meaningful impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint where possible and monitor for suspicious activity related to user role manipulation.