CVE-2026-11519— SourceCodester Inventory System Account Creation users_handler.php improper authorization
Quick assessment
Affected
SourceCodester Inventory System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SourceCodester Inventory System是SourceCodester开源的一个库存系统。 SourceCodester Inventory System 1.0版本存在安全漏洞，该漏洞源于Account Creation Handler组件文件/Product_Inventory/api/users_handler.php中对参数ROLE的操作，可能导致授权不当。攻击者可远程发起攻击。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SourceCodester | Inventory System | 1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11519
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Inventory System Account Creation users_handler.php improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
SourceCodester Inventory System 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SourceCodester Inventory System是SourceCodester开源的一个库存系统。 SourceCodester Inventory System 1.0版本存在安全漏洞，该漏洞源于Account Creation Handler组件文件/Product_Inventory/api/users_handler.php中对参数ROLE的操作，可能导致授权不当。攻击者可远程发起攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Inventory System | 1.0 |
cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-11519
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11519
请登录查看更多情报信息。
Other References for CVE-2026-11519 (1)
Same Patch Batch · SourceCodester · 2026-06-08 · 13 CVEs total
| CVE-2026-11471 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System index2.php sql injection |
| CVE-2026-11472 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System index1.php sql injection |
| CVE-2026-11482 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System archive5.php sql injection |
| CVE-2026-11483 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System archive4.php sql injection |
| CVE-2026-11484 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System archive3.php sql injection |
| CVE-2026-11485 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System archive2.php sql injection |
| CVE-2026-11486 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System archive1.php sql injection |
| CVE-2026-11501 | 7.3 HIGH | SourceCodester Hospitals Patient Records Management System Master.php save_patient sql inj |
| CVE-2026-11515 | 5.3 MEDIUM | SourceCodester Barangay Resident Profiling and Information Management System Password Rese |
| CVE-2026-11552 | 5.3 MEDIUM | SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded |
| CVE-2026-11518 | 4.3 MEDIUM | SourceCodester Inventory System User Management users.php cross site scripting |
| CVE-2026-11520 | 3.5 LOW | SourceCodester Inventory System header.php cross site scripting |
IV. Related Vulnerabilities
Same vendor: SourceCodester
-
CVE-2026-104612
SourceCodester Student Result Management System Announcement -
CVE-2026-104123
SourceCodester Online Reviewer Management System btn_functio -
CVE-2026-102913
SourceCodester Car Driving School Management System Master.p -
CVE-2026-102912
SourceCodester Online Leave Management System page reports s -
CVE-2026-102910
SourceCodester Online Reviewer Management System exam-delete
Same weakness: CWE-285
-
CVE-2026-105121
OpenAM before 16.1.3 Improper Authorization in Delegated Ses -
CVE-2026-105119
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 H -
CVE-2026-103858
MISP Incomplete Thread Authorization Allows Unauthorized Rea -
CVE-2026-103532
immich-app Immich Shared Link Preview access.ts checkSharedL -
CVE-2026-93547
Missing Authorization Check in Vaadin Spreadsheet Allows Cel
V. Comments for CVE-2026-11519
No comments yet