CVE-2026-81202: Missing Authentication in itsourcecode Payroll System

The vulnerability CVE-2026-81202 affects itsourcecode Payroll System 1.0. It arises from missing authentication checks in the create/read/update/delete functions within ajax.php of the CRUD Operation Handler component. By manipulating the 'action' parameter, an attacker can bypass authentication controls remotely, potentially allowing unauthorized access to sensitive payroll operations. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability. Exploit code has been published, but no active exploitation has been reported.

Successful exploitation allows remote attackers to bypass authentication and perform unauthorized CRUD operations on the payroll system. This could lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected ajax.php endpoint and monitor for suspicious activity related to the 'action' parameter.