Medium severity · published Jun 8, 2026
CVE-2026-11519
SourceCodester Inventory System Account Creation users_handler.php improper authorization
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Inventory System · SourceCodester
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11519
vuldb.com
https://vuldb.com/cve/CVE-2026-11519
vuldb.com
https://vuldb.com/submit/836392
vuldb.com
https://vuldb.com/vuln/369139
vuldb.com
https://vuldb.com/vuln/369139/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Inventory System
4.3
CVE-2026-11518
SourceCodester Inventory System User Management users.php cross site scripting
3.5
CVE-2026-112097
SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
3.5
CVE-2026-112096
SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
3.5
CVE-2026-112095
SourceCodester Inventory System Product Management products_handler.php save cross site scripting
3.5
CVE-2026-11520
SourceCodester Inventory System header.php cross site scripting