This vulnerability in Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f involves missing authentication in the DBOperation.addCategory function of the AJAX Backend component. By manipulating the userid argument, an attacker can bypass authentication controls remotely. The product's rolling release model means no explicit versioning information is provided for affected or patched releases. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and partial impacts on confidentiality, integrity, and availability. The vendor has not yet responded, and a public exploit exists.

The vulnerability allows remote attackers to bypass authentication and potentially perform unauthorized actions in the inventory-management-system. This can lead to partial compromise of confidentiality, integrity, and availability of the system. Since the exploit is publicly available, there is an increased risk of exploitation, although no known active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a fix is released, consider restricting access to the affected function or applying compensating controls to limit exposure.