CVE-2026-90565
Received Received - Intake

Improper Access Control in Rizwan17 Inventory Management System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90565
EUVD
EUVD-2026-77039

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rizwan17 inventory_management_system to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f (inc)
rizwan17 inventory-management-system to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper access control flaw in the Rizwan17 inventory-management-system. It allows remote attackers to manipulate the userid argument in dashboard.php, bypassing authentication checks. The issue occurs because the system redirects unauthenticated users to the homepage but fails to stop script execution, exposing sensitive UI elements and endpoints to unauthorized access.

Detection Guidance

Check for unauthorized access to protected pages like dashboard.php or manage_brand.php by sending requests without valid credentials. Use curl to fetch these pages directly and inspect responses for sensitive content or UI elements. Example: curl -v http://<target>/dashboard.php

Monitor HTTP responses for Location headers that redirect but still return full page content. Look for exposed forms or endpoints in the response body.

Impact Analysis

An attacker could exploit this to access protected pages like dashboard.php or manage_brand.php without valid credentials. This may expose sensitive data such as inventory details or application structure. Non-browser tools like curl can retrieve protected content directly, confirming the vulnerability.

Compliance Impact

This vulnerability allows unauthorized access to sensitive UI elements and endpoints, potentially exposing personal or protected health data. GDPR requires strict access controls to prevent unauthorized data exposure, while HIPAA mandates safeguards for protected health information. The flaw could lead to non-compliance with these regulations due to improper access controls.

Mitigation Strategies

Implement proper access controls in dashboard.php and related files to terminate script execution after redirects. Ensure unauthorized requests do not return sensitive content.

Apply input validation for the userid argument to prevent manipulation. Restrict access to protected pages based on valid session or authentication checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart