The toner-management application by raghav993 contains a CWE-862 Missing Authorization vulnerability in its admin state-changing handlers. Specifically, scripts such as add.php, edit.php, and delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories execute database modification operations (INSERT, UPDATE, DELETE) without performing any authentication or authorization checks. Access control is only applied to listing views, allowing unauthorized users to potentially modify data through these endpoints. The vulnerability has a CVSS 3.1 score of 8.2, indicating high severity, with an attack vector of network, no privileges required, no user interaction, and impacts integrity and availability.

Unauthorized attackers can perform database modifications including insertions, updates, and deletions in the toner-management system without any authentication or authorization. This can lead to data integrity loss and partial denial of service due to unauthorized state changes in the system.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the affected admin endpoints through network controls or web application firewalls to prevent unauthorized access.