The vulnerability in code-projects Task Management System 1.0 arises from missing authorization validation in the /user/UpdateTaskStatus.php endpoint. By manipulating the task_id/val argument, an attacker can remotely change task statuses without proper permissions. This flaw has been assigned CVE-2026-19345 with a CVSS 4.0 base score of 6.9 (medium severity). Although the exploit is publicly known, there is no vendor-provided fix or mitigation at this time.

An attacker can remotely modify task statuses without authorization, potentially disrupting task management workflows or causing unauthorized changes. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is limited to the affected functionality within the Task Management System and does not indicate broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint where possible and monitor for suspicious activity related to task status changes.