CVE-2026-109605

Deferred Deferred - Pending Action

Improper Authorization in Simple Cafe Billing System 1.0

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulDB

Description

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109605

EUVD

EUVD-2026-98829

Affected Vendors & Products

Vendor	Product	Version / Range
SourceCodester	Simple	Cafe Billing System 1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in SourceCodester Simple Cafe Billing System 1.0, specifically in the User Management component. It allows improper authorization due to a flaw in the Action::save_user function of admin_class.php. The Type argument can be manipulated, enabling remote attacks.

Detection Guidance

This vulnerability involves improper authorization in the Simple Cafe Billing System 1.0 due to manipulation of the Type argument in admin_class.php. To detect it, inspect the admin_class.php file for the Action::save_user function and check if Type parameter handling lacks proper authorization checks. Look for unauthenticated or unauthorized access attempts in server logs.

Impact Analysis

An attacker could exploit this to gain unauthorized access or perform actions beyond their privileges. Since the exploit is public, the risk of real-world attacks is higher. Systems using this software may face data breaches or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage due to insufficient security controls.

Mitigation Strategies

Immediately restrict access to the admin_class.php file in the User Management component. Review and update authorization checks for the Type argument in the Action::save_user function. Apply patches or updates if available from the vendor.

Hi! I’m here to help you understand CVE-2026-109605. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70