CVE-2026-19345
Received Received - Intake

Missing Authorization in Task Management System

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19345
EUVD
EUVD-2026-54914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects task_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated task status modification flaw in the Code-Projects Task Management System. The UpdateTaskStatus.php endpoint fails to enforce proper authorization checks. When an unauthenticated user tries to modify a task status, the system redirects them to a logout page but still executes the database update, allowing unauthorized changes to task statuses.

Detection Guidance

To detect this vulnerability, monitor for unauthorized POST requests to /user/UpdateTaskStatus.php with task_id or val parameters. Check server logs for attempts to modify task statuses without valid sessions. Use tools like Burp Suite or curl to send test requests to the endpoint and observe if the system processes them without proper authentication.

Impact Analysis

An attacker could remotely exploit this to modify task statuses without authentication. This could lead to unauthorized changes in workflow records, loss of task-state integrity, and potential disruption of task management operations.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modifications to task statuses, potentially compromising data integrity and confidentiality. Unauthorized changes may violate record-keeping requirements under these regulations.

Mitigation Strategies

Immediately terminate script execution after authentication failures in UpdateTaskStatus.php. Ensure proper HTTP 401 or 403 responses are returned. Validate user ownership of tasks and sanitize input parameters. Use prepared statements for database operations to prevent SQL injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart