Skip to content
Threat Feed
Subscribe
high advisory

CVE-2026-14690: Improper Authorization in SourceCodester Multi-Vendor Online Grocery Management System

A high-severity improper authorization vulnerability (CVE-2026-14690) in the `save_users` function of SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows remote unauthenticated attackers to manipulate user accounts, potentially leading to privilege escalation or unauthorized access, with a public exploit readily available.

A significant security flaw, tracked as CVE-2026-14690, has been identified in SourceCodester Multi-Vendor Online Grocery Management System version 1.0. This vulnerability specifically resides within the save_users function located in the classes/Users.php file. The weakness stems from improper authorization controls, allowing an attacker to bypass security checks and manipulate user accounts. Remote exploitation is possible, meaning attackers do not need prior access to the system or user credentials. A public exploit has been made available, increasing the urgency for immediate remediation. For defenders, this vulnerability represents a critical risk of unauthorized access, privilege escalation, and potential compromise of the online grocery management system, including sensitive customer and transactional data.

Attack Chain

  1. An unauthenticated remote attacker identifies the vulnerable SourceCodester Multi-Vendor Online Grocery Management System 1.0 instance.
  2. The attacker crafts a malicious HTTP POST request targeting the /classes/Users.php endpoint to invoke the save_users function.
  3. Due to the improper authorization flaw, the application fails to adequately verify the attacker's privileges or authentication status for the save_users operation.
  4. The attacker leverages this bypass to create a new administrative user account or modify the roles/privileges of an existing low-privileged user.
  5. With the newly acquired or elevated administrative credentials, the attacker logs into the system.
  6. The attacker gains full administrative control over the Multi-Vendor Online Grocery Management System, potentially leading to data exfiltration, system defacement, or further compromise of the underlying server.

Impact

Successful exploitation of CVE-2026-14690 would grant unauthorized administrative access to the Multi-Vendor Online Grocery Management System. This direct compromise could lead to severe consequences, including the theft of sensitive customer information (e.g., personal data, order history), financial transaction manipulation, alteration of product inventories, or complete disruption of the online grocery platform. While specific victim counts are not available, any organization utilizing this vulnerable software is at risk of significant reputational damage, financial loss, and regulatory penalties due to data breaches and service interruptions.

Recommendation

  • Immediately apply any available patches or security updates from SourceCodester for the Multi-Vendor Online Grocery Management System 1.0 to address CVE-2026-14690.
  • Review access logs for /classes/Users.php for any unauthorized or suspicious POST requests that occurred prior to applying the patch for CVE-2026-14690.
  • Perform an audit of user accounts, especially administrative accounts, for any newly created or modified users since the system's deployment or the disclosure of CVE-2026-14690, investigating any anomalous entries.
  • Refer to the provided references (https://vuldb.com/cve/CVE-2026-14690, https://github.com/lee945/cve/issues/1) for further details on the vulnerability and potential mitigation strategies.