{"id":"CVE-2026-10693","state":"PUBLISHED","title":"SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization","description":"A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.","publishedAt":"2026-06-03T00:00:12.858Z","updatedAt":"2026-06-03T14:07:35.177Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Online Boat Reservation System"],"affected":[{"vendor":"SourceCodester","product":"Online Boat Reservation System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_boat_reservation_system:*:*:*:*:*:*:*:*"],"modules":["Administrative Endpoint"]}],"references":["https://vuldb.com/vuln/367962","https://vuldb.com/vuln/367962/cti","https://vuldb.com/cve/CVE-2026-10693","https://vuldb.com/submit/830894","https://medium.com/@hemantrajbhati5555/broken-access-control-in-sourcecodester-online-boat-reservation-system-1-0-4ed0380d2222","https://www.sourcecodester.com/"],"weaknesses":["CWE-285","CWE-266"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/10xxx/CVE-2026-10693.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-10693","state":"PUBLISHED","datePublished":"2026-06-03T00:00:12.858Z","dateUpdated":"2026-06-03T14:07:35.177Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-02T15:44:47.102Z"},"containers":{"cna":{"title":"SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected."}],"affected":[{"vendor":"SourceCodester","product":"Online Boat Reservation System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_boat_reservation_system:*:*:*:*:*:*:*:*"],"modules":["Administrative Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/367962","name":"VDB-367962 | SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/367962/cti","name":"VDB-367962 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-10693","name":"CVE-2026-10693 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/830894","name":"Submit #830894 | SourceCodester Online Boat Reservation System  1.0 Broken Access Control","tags":["third-party-advisory"]},{"url":"https://medium.com/@hemantrajbhati5555/broken-access-control-in-sourcecodester-online-boat-reservation-system-1-0-4ed0380d2222","tags":["broken-link","exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-03T00:00:12.858Z"},"timeline":[{"time":"2026-06-02T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-02T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-02T17:49:50.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Hemant Raj Bhati (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-03T13:17:37.731971Z","id":"CVE-2026-10693","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-03T14:07:35.177Z"}}]}}}