The vulnerability CVE-2026-90840 affects PHPGurukul Blood Donor Management System version 1.0. It is located in the __construct function of the Admin Controllers component within the file /application/controllers/admin/Dashboard.php. The issue causes improper authentication, enabling remote attackers to potentially bypass authentication controls. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. Public exploit code is available, but no evidence of active exploitation is noted. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication mechanisms in the affected system, potentially granting unauthorized access to administrative functions. This could lead to unauthorized data access or modification within the Blood Donor Management System. However, the impact is rated medium, indicating limited or partial impact on confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the affected component and employing additional authentication controls may help reduce risk.