CVE-2026-90566: Improper Authorization in Rizwan17 inventory-management-system
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
AI Analysis
Technical Summary
This vulnerability in Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f involves improper authorization in the createUserAccount function of register.php within the Registration Handler component. By manipulating the usertype argument, an attacker can bypass authorization controls remotely. The product uses rolling releases, so specific affected or fixed versions are not provided. The vendor has been notified but has not yet addressed the issue. Public exploit code exists, increasing the risk of exploitation.
Potential Impact
An attacker can remotely exploit this vulnerability to perform unauthorized actions related to user account creation by manipulating the usertype parameter. This could lead to privilege escalation or unauthorized access within the inventory-management-system. The vulnerability has a medium severity rating (CVSS 6.9), indicating a significant but not critical impact.
Mitigation Recommendations
No official fix or patch is currently available. Due to the rolling release model, version-specific remediation details are not provided. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the registration functionality or implementing additional authorization checks as a temporary mitigation.
CVE-2026-90566: Improper Authorization in Rizwan17 inventory-management-system
Description
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0
Score 6.9medium
Affected software
Rizwan17
inventory-management-system
cpe:2.3:a:rizwan17:inventory-management-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f involves improper authorization in the createUserAccount function of register.php within the Registration Handler component. By manipulating the usertype argument, an attacker can bypass authorization controls remotely. The product uses rolling releases, so specific affected or fixed versions are not provided. The vendor has been notified but has not yet addressed the issue. Public exploit code exists, increasing the risk of exploitation.
Potential Impact
An attacker can remotely exploit this vulnerability to perform unauthorized actions related to user account creation by manipulating the usertype parameter. This could lead to privilege escalation or unauthorized access within the inventory-management-system. The vulnerability has a medium severity rating (CVSS 6.9), indicating a significant but not critical impact.
Mitigation Recommendations
No official fix or patch is currently available. Due to the rolling release model, version-specific remediation details are not provided. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the registration functionality or implementing additional authorization checks as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-12T15:51:47.111Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa71fdf55bf5e2cf521a4e3
Added to database: 09/13/2026, 22:12:47 UTC
Last enriched: 09/13/2026, 22:14:09 UTC
Last updated: 09/14/2026, 03:06:17 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.