Login Request a demo
Medium severity · published Jun 29, 2026
CVE-2026-13549
CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Complaint Management System · CodeAstro
1.0 · source: vendor
Affected product
CM
Complaint Management System
CodeAstro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13549
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13549
codeastro.com
https://codeastro.com/
github.com
https://github.com/ashikmd0507/CVE/tree/main/Unauthenticated%20Arbitrary%20Report%20%26%20File%20Deletion
vuldb.com
https://vuldb.com/cve/CVE-2026-13549
vuldb.com
https://vuldb.com/submit/843260
vuldb.com
https://vuldb.com/vuln/374557
vuldb.com
https://vuldb.com/vuln/374557/cti
More from Complaint Management System
9.8
CVE-2024-55507
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component
9.8
CVE-2024-55509
SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the…
8.8
CVE-2024-55506
An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via…
8.8
CVE-2024-55505
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component
7.5
CVE-2024-56889
Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via…