CVE-2026-90697
Received Received - Intake

Authorization Bypass in Inventory Management System via invoice.php ID Parameter

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90697
EUVD
EUVD-2026-77329

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester inventory_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in SourceCodester Inventory Management System 1.0. It occurs in the invoice.php file where the ID argument can be manipulated to access invoices without proper permissions. The flaw allows any authenticated user, even low-privileged ones, to view all invoices by changing the id parameter in the URL, exposing sensitive customer data.

Detection Guidance

Check for unauthorized access to invoice.php by monitoring URL parameters for ID manipulation. Test with authenticated low-privilege users attempting to access other users' invoices by changing the id parameter in the URL. Look for sensitive data exposure in responses.

Impact Analysis

If you use this system, unauthorized users could access sensitive invoice data, including customer names, contact details, purchases, sale amounts, and transaction history. This could lead to data breaches, privacy violations, and potential misuse of financial information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. GDPR mandates strict access controls and data minimization, while HIPAA requires safeguards to protect sensitive health-related information. Unauthorized access to invoices could result in non-compliance penalties.

Mitigation Strategies

Implement authorization checks in invoice.php to verify user ownership of invoices. Restrict invoice access to admin roles only. Apply input validation to prevent ID manipulation. Update the application to enforce proper access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart