CVE-2026-10876
BaseFortify
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | ship_ferry_ticket_reservation_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization issue in the SourceCodester Ship/Ferry Ticket Reservation System. It allows low-privileged authenticated users to access administrative functions without proper authorization checks.
Specifically, users with normal or staff privileges can manually browse restricted administrative pages and access sensitive endpoints such as vessel management, port management, accommodation management, reservation management, and administrative reports.
The root cause is the application's failure to validate user privileges on the server side, enabling unauthorized access to privileged modules.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to privilege escalation, allowing unauthorized users to gain administrative access.
This can result in exposure of sensitive data and unauthorized modification of application resources.
Ultimately, it could lead to a complete compromise of the administrative functionality of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access administrative endpoints without proper authorization using a low-privileged authenticated user account.
Manual testing involves logging in as a normal or staff user and trying to browse restricted administrative pages such as /admin/?page=maintenance/ship or /admin/?page=maintenance/port.
If these pages are accessible without proper authorization checks, the system is vulnerable.
Network detection could involve monitoring HTTP requests to the /admin/ path and checking for unauthorized access attempts.
Specific commands are not provided in the resources, but using tools like curl or a web browser to manually access these URLs with low-privileged credentials can help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing server-side authorization checks to enforce role-based access control (RBAC).
Access to privileged administrative endpoints should be restricted and validated on every request to ensure only authorized users can access them.
Review and update the application code to validate user permissions before granting access to sensitive modules such as vessel management, port management, accommodation management, reservation management, and administrative reports.
Until a patch or fix is applied, consider limiting access to the /admin/ directory by network controls or IP whitelisting if possible.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized access to administrative functions and sensitive data by bypassing role-based access controls. This unauthorized access and potential exposure or modification of sensitive information can lead to non-compliance with common standards and regulations such as GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.
Specifically, the failure to enforce proper authorization and privilege validation increases the risk of data breaches and unauthorized data manipulation, which are critical compliance violations under these regulations.