CVE-2026-5326

🎯 CVE-2026-5326 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-5326 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

Klassifikation & Betroffenheit:

CWE-285CWE-639 SourceCodester Leave Application System 1.0

Improper Authorization 🎯 High

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

🛡️ Empfohlene Mitigation: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authoriza…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-1 · Accessing Functionality Not Properly Con… (High) CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-17 · Using Malicious Files (Very High) CAPEC-39 · Manipulating Opaque Client-based Data To… (Medium) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-104 · Cross Zone Scripting (High) CAPEC-127 · Directory Indexing (Medium) CAPEC-402 · Bypassing ATA Password Security

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1574.010 · Hijack Execution Flow: ServicesFil… T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce… T1574.005 · Hijack Execution Flow: Executable … T1083 · File and Directory Discovery

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2022-4062 7.8 CVE-2023-52539 7.5 CVE-2021-36183 7.4 CVE-2024-36438 7.3 CVE-2024-4349 7.3

📰 Eigene Berichterstattung: ➔ CVE-2026-5326 | SourceCodester Leave Application System 1.0 User Information ind

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 04/2026

Heute 31.10.

CVSS-Vektor-Analyse: 6.9

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CNA-Bewertung (VulDB): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA…

Veröffentlicht:02.04.2026

Aktualisiert:26.10.2026 21:10

Assigner (CNA):VulDB

EUVD-ID:EUVD-2026-18188

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	743	0,2 %
≥50 %	3.224	0,8 %
≥10 %	22.067	5,8 %
<10 %	354.695	93,2 %

6.9 MEDIUM

EPSS

0.4%

CVE-2026-5326 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

SourceCodester

CVE-2026-5326 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 6 Monaten ↻ vor 6 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub