CVE-2026-86292
Received Received - Intake

Authentication Bypass in Simple Traffic Offense System

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86292
EUVD
EUVD-2026-72321

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester simple_traffic_offense_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Simple Traffic Offense System 1.0 where the saveuser.php file lacks authentication checks. Attackers can manipulate the position parameter to create an admin account without proper validation, bypassing session requirements. This leads to unauthorized administrative access and potential system compromise.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to saveuser.php for unauthenticated admin account creation attempts. Look for POST requests with modified position parameters set to admin without valid session cookies. Use tools like Burp Suite or OWASP ZAP to intercept and inspect traffic for missing authentication checks.

Impact Analysis

An attacker could gain full administrative access to the system, allowing them to view, modify, or delete sensitive data. They could also perform privileged actions, such as creating additional admin accounts or altering system configurations, leading to complete system takeover.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Non-compliance may result in legal penalties, fines, and reputational damage due to exposed sensitive data.

Mitigation Strategies

Immediately restrict access to saveuser.php and related files. Implement server-side authentication and authorization checks for admin role assignments. Remove client-side role assignment logic and enforce session-based restrictions. Apply CSRF protection and add audit logging for admin actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart