CVE-2026-2009 Overview
CVE-2026-2009 is an improper access control vulnerability [CWE-266] in SourceCodester Gas Agency Management System 1.0, distributed by Mayurik. The flaw resides in the /gasmark/php_action/createUser.php endpoint, which fails to properly enforce authorization checks on user-creation operations. An authenticated low-privilege attacker can manipulate the request remotely to perform actions reserved for higher-privileged accounts. A public exploit has been disclosed through VulDB and a GitHub proof-of-concept repository, increasing the risk of opportunistic abuse against exposed deployments.
Critical Impact
Remote attackers with low privileges can abuse createUser.php to bypass access controls and create or modify user accounts, undermining the integrity of the application.
Affected Products
- Mayurik Gas Agency Management System 1.0
- SourceCodester Gas Agency Management System (distributed build)
- Deployments exposing the /gasmark/php_action/createUser.php endpoint
Discovery Timeline
- 2026-02-06 - CVE-2026-2009 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-2009
Vulnerability Analysis
The vulnerability is classified as Improper Privilege Management [CWE-266]. The affected script, createUser.php, processes account-creation requests without verifying whether the calling session holds an administrative role. Because the authorization check is missing or insufficient, any authenticated user can submit a crafted HTTP request to the endpoint and trigger user-creation logic.
The attack is exploitable over the network and requires only low privileges. No user interaction is needed. Successful exploitation results in limited compromise of confidentiality, integrity, and availability, primarily affecting the application's account model. The public disclosure on VulDB and a GitHub PoC repository raise the practical exposure for unpatched instances.
Root Cause
The root cause is a missing server-side authorization check in php_action/createUser.php. The endpoint relies on client-side role assumptions rather than validating the session's privilege level against the requested action. This design flaw allows lower-privileged sessions to invoke privileged functionality directly.
Attack Vector
An attacker authenticates with any valid low-privileged account, then issues a direct POST request to /gasmark/php_action/createUser.php with parameters that define a new user. Because the script does not validate the caller's role, the request is processed as if it originated from an administrator. Technical details are documented in the GitHub PoC Repository and VulDB entry 344591.
Detection Methods for CVE-2026-2009
Indicators of Compromise
- POST requests to /gasmark/php_action/createUser.php originating from non-administrative session cookies
- Unexpected new user accounts in the users table, particularly with administrator-level roles
- HTTP access logs showing repeated createUser.php invocations from a single low-privilege session
Detection Strategies
- Review web server access logs for requests to php_action/createUser.php and correlate with the authenticated user role at the time of the request
- Add application-layer monitoring that flags privilege transitions performed without an administrator session
- Compare account creation events against a baseline of approved administrative activity
Monitoring Recommendations
- Enable verbose logging on the php_action/ directory to capture full request metadata
- Alert on creation of accounts outside business hours or from unusual source IPs
- Track authentication events alongside administrative actions to identify role mismatches
How to Mitigate CVE-2026-2009
Immediate Actions Required
- Restrict network access to the Gas Agency Management System to trusted users until a fix is applied
- Audit existing user accounts and remove any that were not provisioned by an administrator
- Add a server-side authorization check at the top of createUser.php that rejects non-administrator sessions
Patch Information
At the time of publication, no official vendor patch is referenced in the NVD entry for Mayurik Gas Agency Management System 1.0. Operators should consult the SourceCodester project page for updates and apply source-level fixes that enforce role validation in all php_action/ scripts.
Workarounds
- Place the application behind a reverse proxy that restricts /gasmark/php_action/createUser.php to administrator IP ranges
- Implement a web application firewall rule that blocks requests to createUser.php lacking an administrator session token
- Disable the user-creation feature if it is not required for current operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
