{"id":"CVE-2026-90856","state":"PUBLISHED","title":"SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management","description":"A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.","publishedAt":"2026-09-15T03:00:11.275Z","updatedAt":"2026-09-15T13:54:14.214Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester College Notes Gallery Management System"],"affected":[{"vendor":"SourceCodester","product":"College Notes Gallery Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:college_notes_gallery_management_system:*:*:*:*:*:*:*:*"],"modules":["Registration Flow"]}],"references":["https://vuldb.com/vuln/403413","https://vuldb.com/vuln/403413/cti","https://vuldb.com/cve/CVE-2026-90856","https://vuldb.com/submit/927252","https://github.com/Andyov0/cve/issues/4","https://www.sourcecodester.com/"],"weaknesses":["CWE-269","CWE-266"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90856.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90856","state":"PUBLISHED","datePublished":"2026-09-15T03:00:11.275Z","dateUpdated":"2026-09-15T13:54:14.214Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-14T05:50:46.224Z"},"containers":{"cna":{"title":"SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"vendor":"SourceCodester","product":"College Notes Gallery Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:college_notes_gallery_management_system:*:*:*:*:*:*:*:*"],"modules":["Registration Flow"]}],"references":[{"url":"https://vuldb.com/vuln/403413","name":"VDB-403413 | SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/403413/cti","name":"VDB-403413 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-90856","name":"CVE-2026-90856 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/927252","name":"Submit #927252 | SourceCodester College Notes Gallery Management System using PHP with Source Code 1.0 Missing Authorization","tags":["third-party-advisory"]},{"url":"https://github.com/Andyov0/cve/issues/4","tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"Improper Privilege Management"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-15T03:00:11.275Z"},"timeline":[{"time":"2026-09-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-14T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-14T07:55:56.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Andyqaq (VulDB User)","type":"reporter"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-15T13:47:13.174633Z","id":"CVE-2026-90856","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-15T13:54:14.214Z"}}]}}}