CVE-2026-71252 describes a missing authorization vulnerability (CWE-862) in the toner-management application by raghav993. Specifically, the admin state-changing handlers responsible for adding, editing, and deleting records in admin/toners, admin/toner-brands, admin/printers, and related directories executed INSERT, UPDATE, and DELETE operations without any authentication or authorization checks. Access control was only enforced on listing views, not on these critical state-changing endpoints. This flaw allowed unauthenticated remote attackers to directly invoke these handlers and manipulate application data arbitrarily. The vendor has since merged a fix that enforces an authenticated admin session requirement before allowing these operations.

An unauthenticated remote attacker could perform unauthorized create, modify, or delete operations on application data, leading to integrity loss and partial availability impact. The CVSS 3.1 score of 8.2 reflects high severity due to the ease of exploitation (no privileges or user interaction required) and the significant impact on data integrity and availability.

The vendor has merged an official fix that requires an authenticated admin session before any state-changing handler executes. Users should update to the fixed version once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.