CVE-2026-96556

Received Received - Intake

Improper Authorization in Neethuharii CafeManagement

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description

A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-96556

EUVD

EUVD-2026-85635

Affected Vendors & Products

Vendor	Product	Version / Range
neethuharii	cafemanagement	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authorization flaw in Neethuharii CafeManagement. It exists in the addcashier function of AddCashierCode.php where manipulating arguments like uname, pass, role, or status can bypass authorization checks. This allows unauthorized remote attackers to perform actions they shouldn't be able to.

Impact Analysis

An attacker could exploit this to create unauthorized cashier accounts with elevated privileges. This could lead to unauthorized access to the system, data theft, or manipulation of cafe operations. Since the exploit is publicly available, the risk of exploitation is higher.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the AddCashierCode.php file and disable the addcashier function if possible. Review and audit user roles and permissions to ensure proper authorization. Monitor network traffic for suspicious activity targeting this vulnerability.

Hi! I’m here to help you understand CVE-2026-96556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70