CVE-2026-13568— SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control
Quick assessment
Affected
SourceCodester Inventory Management System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SourceCodester Inventory Management System是SourceCodester社区的一款库存管理软件。 SourceCodester Inventory Management System 1.0版本存在权限许可和访问控制问题漏洞，该漏洞源于User Registration Endpoint组件中文件/api/users_handler.php的role参数操作导致访问控制不当，可能允许远程攻击者利用。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SourceCodester | Inventory Management System | 1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13568
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
sourcecodester Inventory Management System 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SourceCodester Inventory Management System是SourceCodester社区的一款库存管理软件。 SourceCodester Inventory Management System 1.0版本存在权限许可和访问控制问题漏洞，该漏洞源于User Registration Endpoint组件中文件/api/users_handler.php的role参数操作导致访问控制不当，可能允许远程攻击者利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Inventory Management System | 1.0 |
cpe:2.3:a:sourcecodester:inventory_management_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-13568
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13568
请登录查看更多情报信息。
Other References for CVE-2026-13568 (1)
Same Patch Batch · SourceCodester · 2026-06-29 · 8 CVEs total
| CVE-2026-13566 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System preview3.php sql injection |
| CVE-2026-13565 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System edit_class1.php sql injection |
| CVE-2026-13527 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System preview4.php sql injection |
| CVE-2026-13526 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System edit_class.php sql injection |
| CVE-2026-13521 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System preview5.php sql injection |
| CVE-2026-13571 | 5.3 MEDIUM | SourceCodester Simple Food Ordering System cart.php logic error |
| CVE-2026-13570 | 3.5 LOW | SourceCodester Inventory Management System User Registration Endpoint users_handler.php cr |
IV. Related Vulnerabilities
Same product: Inventory Management System
-
CVE-2026-90697
SourceCodester Inventory Management System invoice.php autho -
CVE-2026-90696
SourceCodester Inventory Management System Product Managemen -
CVE-2026-90695
SourceCodester Inventory Management System Vendor Management -
CVE-2026-90694
SourceCodester Inventory Management System Customer Manageme -
CVE-2026-13570
SourceCodester Inventory Management System User Registration
Same vendor: SourceCodester
-
CVE-2026-104612
SourceCodester Student Result Management System Announcement -
CVE-2026-104123
SourceCodester Online Reviewer Management System btn_functio -
CVE-2026-102913
SourceCodester Car Driving School Management System Master.p -
CVE-2026-102912
SourceCodester Online Leave Management System page reports s -
CVE-2026-102910
SourceCodester Online Reviewer Management System exam-delete
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2026-13568
No comments yet