The vulnerability CVE-2026-19345 affects code-projects Task Management System 1.0. It is caused by missing authorization checks in the /user/UpdateTaskStatus.php endpoint, specifically when handling the task_id/val argument. This flaw allows remote attackers to manipulate task status updates without proper permissions. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low impact on confidentiality and availability, and no privileges or user interaction required. Public exploit code is available, but no official fix or patch has been published as of the data provided.

An attacker can remotely exploit this vulnerability to update task statuses without authorization, potentially leading to unauthorized modification of task data. The impact is rated medium severity with limited impact on confidentiality and availability. There is no indication of privilege escalation or user interaction required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. In the meantime, restricting access to the vulnerable endpoint and implementing additional authorization checks at the application or network level may help mitigate risk.