{"id":"CVE-2026-96556","state":"PUBLISHED","title":"Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization","description":"A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-23T20:15:07.264Z","updatedAt":"2026-09-24T13:55:04.912Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Neethuharii CafeManagement"],"affected":[{"vendor":"Neethuharii","product":"CafeManagement","versions":[{"version":"5f743043a9a04f903678697f061d2e220e544c09","status":"affected"},{"version":"66c837020e25af4866cb69b23ec3af4e0e1510c9","status":"affected"},{"version":"f80fe4442d5e15af5c78df3f22177a131c1e6f32","status":"affected"}],"cpes":["cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/408959","https://vuldb.com/vuln/408959/cti","https://vuldb.com/cve/CVE-2026-96556","https://vuldb.com/submit/898980","https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md"],"weaknesses":["CWE-285","CWE-266"],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/96xxx/CVE-2026-96556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96556","state":"PUBLISHED","datePublished":"2026-09-23T20:15:07.264Z","dateUpdated":"2026-09-24T13:55:04.912Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-23T13:08:44.247Z"},"containers":{"cna":{"title":"Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization","descriptions":[{"lang":"en","value":"A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Neethuharii","product":"CafeManagement","versions":[{"version":"5f743043a9a04f903678697f061d2e220e544c09","status":"affected"},{"version":"66c837020e25af4866cb69b23ec3af4e0e1510c9","status":"affected"},{"version":"f80fe4442d5e15af5c78df3f22177a131c1e6f32","status":"affected"}],"cpes":["cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/408959","name":"VDB-408959 | Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/408959/cti","name":"VDB-408959 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-96556","name":"CVE-2026-96556 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/898980","name":"Submit #898980 | github Cafe Management System (CafeManagement) 1.0 Missing Authentication → Unauthenticated Privileged Account Crea","tags":["third-party-advisory"]},{"url":"https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-23T20:15:07.264Z"},"timeline":[{"time":"2026-09-23T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-23T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-23T15:14:36.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Yashkumar Keral (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T13:52:55.697306Z","id":"CVE-2026-96556","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T13:55:04.912Z"}}]}}}