CVE-2026-14690 identifies an improper authorization vulnerability in SourceCodester Multi-Vendor Online Grocery Management System 1.0, specifically in the save_users function of classes/Users.php. This weakness allows remote attackers to bypass authorization controls, potentially enabling unauthorized actions related to user management. The vulnerability is remotely exploitable without requiring privileges or user interaction. Although exploit code is publicly accessible, there are no confirmed reports of exploitation in the wild. No vendor advisory or patch information is currently available.

The vulnerability enables remote attackers to bypass authorization mechanisms in the user management functionality, which could lead to unauthorized modifications of user data or privileges. This may compromise the integrity of the system's user management processes. The CVSS score of 6.9 indicates a medium severity impact. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality and monitor for suspicious activity related to user management. Avoid deploying the affected version in untrusted environments.