This vulnerability in Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f allows remote attackers to bypass access controls by manipulating the userid parameter in an unknown function within dashboard.php. The flaw results in improper access control, potentially exposing sensitive information or functionality. The product's rolling release model means no discrete versioning is provided for affected or patched states. The vendor has not responded to the issue report, and public exploit code has been released.

The improper access control vulnerability allows unauthenticated remote attackers to manipulate the userid argument to bypass intended access restrictions. This could lead to unauthorized access to user-specific data or functionality within the inventory-management-system. The availability of public exploit code increases the likelihood of exploitation in the wild. However, no known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no fix is publicly available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the dashboard.php functionality or implementing additional access control checks as a temporary mitigation.