Improper Authorization Vulnerability in SourceCodester Simple Cafe Billing System

A security vulnerability identified as CVE-2026-109605 has been discovered in the SourceCodester Simple Cafe Billing System version 1.0. The vulnerability resides in the Action::save_user function within the admin_class.php file, specifically affecting the component responsible for User Management. By manipulating the 'Type' argument during a request, an unauthenticated or low-privileged remote attacker can bypass intended authorization controls. This vulnerability has been disclosed publicly, and functional exploit code may be available. Given that this system is intended for billing and user management, unauthorized administrative access could lead to full system compromise or financial data exposure.

Impact

Successful exploitation of this vulnerability allows unauthorized users to modify user permissions or roles within the billing system. This can lead to privilege escalation, unauthorized access to sensitive billing records, and full compromise of the administrative interface. The Simple Cafe Billing System is often deployed in small retail or hospitality environments where the confidentiality of transaction and customer data is critical.

Recommendation

1. Audit existing user account configurations in the Simple Cafe Billing System to identify any suspicious roles assigned to non-administrative accounts.
2. Implement strict network access controls to limit access to the administrative interface of the billing system to authorized management subnets only.
3. Contact the vendor for patches; if no patch is available, implement a Web Application Firewall (WAF) rule to validate the 'Type' argument in POST requests to admin_class.php, ensuring that only expected, legitimate role strings are permitted.