- **Vulnerability ID:** VDB-344591（CVE-2026-2009） - **Affected Product:** SourceCodester Gas Agency Management System 1.0 - **Vulnerability Type:** Access Control - **CVSS Score:** 5.7 - **Exploit Price Range:** $0-$5k - **CTI Interest Score:** 3.12 - **Summary:** - A critical vulnerability was found in SourceCodester Gas Agency Management System 1.0. - The vulnerability is due to improper access control in the createUser.php file. - The vulnerability can be exploited remotely and an exploit is publicly available. - **Details:** - The issue impacts confidentiality, integrity, and availability. - The vulnerability can be mitigated by addressing CWE-284 (Improper Access Control). - The product does not properly restrict access from an unauthorized actor. - An exploit proof-of-concept is available on GitHub. - The vulnerability identifier is CVE-2026-2009 and is classified as critical according to the MITRE ATT&CK framework (T1068 technique).