CVE-2026-86293: Missing Authentication in SourceCodester Simple Traffic Offense System

CVE-2026-86293 is a missing authentication vulnerability in SourceCodester Simple Traffic Offense System 1.0 affecting the delete-user.php deletion endpoint. An attacker can remotely manipulate the ID parameter to bypass authentication controls, potentially allowing unauthorized deletion of user accounts or data. The vulnerability is publicly known with published exploit code, but no active exploitation has been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality and availability, with limited impact on integrity.

The vulnerability allows remote attackers to bypass authentication and perform unauthorized deletion operations on user accounts or related data via the delete-user.php endpoint. This could lead to data loss or disruption of service for affected users. The impact is limited to the functionality exposed by the deletion endpoint and does not indicate broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the deletion endpoint where possible, such as through network-level controls or application firewalls, to mitigate unauthorized access.