CVE-2026-94048
Received Received - Intake

Improper Privilege Management in CodeAstro QR Code Attendance System

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument role_id results in improper privilege management. The attack can be executed remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94048
EUVD
EUVD-2026-83782

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
codeastro qr_code_attendance_management_system 1.0
witiers qr_code_attendance_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in CodeAstro QR Code Attendance Management System 1.0. It allows improper privilege management by manipulating the role_id argument in the Save function of app/Controllers/UserController.php. An authenticated user can escalate privileges by updating the Super Administrator account without proper verification.

Detection Guidance

To detect this vulnerability, inspect the UserController.php file in the app/Controllers directory for the Save function. Check if it validates the role_id parameter against the current user's role before processing updates. Look for improper privilege checks that allow modifying the Super Administrator account (ID 1).

Commands to check: grep -r "Save" app/Controllers/UserController.php to locate the function. Review the code for role_id handling and privilege validation logic.

Impact Analysis

An attacker could take over the Super Administrator account, lock out the original admin, alter audit logs, change account roles or passwords, and access all personnel records and attendance data. This could lead to data breaches, unauthorized modifications, and loss of system integrity.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data and compromising data integrity. For HIPAA, it risks unauthorized access to protected health information, breaching confidentiality and audit requirements. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the UserController.php file to enforce role-based access control. Ensure the Save function verifies the current user's role before allowing modifications to any account, especially the Super Administrator (ID 1).

Restrict access to the system until the fix is applied. Monitor logs for unauthorized attempts to modify privileged accounts. Consider revoking all active sessions after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart