CVE-2026-90518
Received Received - Intake

Improper Access Control in PHPGurukul Bank Locker Management System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90518
EUVD
EUVD-2026-77006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpgurukul bank_locker_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken access control flaw in PHPGurukul Bank Locker Management System 1.0. It allows Sub-Admins to escalate privileges and perform unauthorized actions by manipulating the UserType argument in certain files like sidebar.php. The system relies on client-side checks but lacks proper server-side role verification, enabling direct access to Admin-only pages via crafted URLs.

Detection Guidance

Check for unauthorized access to Admin-exclusive pages by Sub-Admins by monitoring HTTP requests to endpoints like /blms/banker/manage-subadmins.php, /blms/banker/add-subadmin.php, and /blms/banker/edit-subadmin.php. Look for requests with UserType=0 bypassing server-side checks.

Impact Analysis

An attacker with a valid Sub-Admin session can exploit this to delete Admin accounts, create or delete Sub-Admins, modify banker accounts, reset passwords, and perform other unauthorized actions. The attack can be launched remotely if the attacker gains a Sub-Admin session through default credentials, cracked hashes, or SQL injection.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, which may violate GDPR's data integrity and confidentiality requirements and HIPAA's access controls for protected health information. Unauthorized privilege escalation could result in unauthorized data exposure or tampering, posing compliance risks.

Mitigation Strategies

Implement server-side role checks for all Sub-Admin management endpoints. Ensure UserType constraints are enforced in database queries. Remove default credentials and patch any SQL injection vulnerabilities in banker/index.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart