CVE-2026-90517: PHPGurukul Bank Locker Auth Bypass Flaw

CVE-2026-90517 is an authorization bypass vulnerability in PHPGurukul Bank Locker Management System 1.0 affecting view-assign-locker.php. Attackers can manipulate the ltid parameter to bypass authentication remotely. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-90517 Overview

CVE-2026-90517 is an authorization bypass vulnerability in PHPGurukul Bank Locker Management System 1.0. The flaw resides in the /blms/view-assign-locker.php script, where the ltid parameter is not properly validated against the requesting user's authorization context. An unauthenticated remote attacker can manipulate the ltid argument to access locker assignment records that should be restricted. The vulnerability is classified under CWE-285: Improper Authorization. Public exploit details have been disclosed through third-party vulnerability databases, increasing the likelihood of opportunistic scanning against exposed installations.

Critical Impact
Remote attackers can bypass authorization controls on /blms/view-assign-locker.php and access locker assignment data without credentials.

Affected Products

PHPGurukul Bank Locker Management System 1.0
Component: /blms/view-assign-locker.php
Vulnerable parameter: ltid

Discovery Timeline

2026-09-13 - CVE-2026-90517 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90517

Vulnerability Analysis

The vulnerability affects the view-assign-locker.php endpoint in the PHPGurukul Bank Locker Management System. The application fails to enforce proper authorization checks when handling the ltid (locker assignment identifier) request parameter. An attacker who modifies the value of ltid can retrieve records associated with other users or locker assignments they should not be able to view.

This is a classic Insecure Direct Object Reference (IDOR) pattern falling under CWE-285: Improper Authorization. The endpoint accepts the identifier from the client and returns the corresponding record without validating whether the requesting session owns or is permitted to access the object. Exploit information has been published on public tracking sources, including the VulDB CVE Report.

Root Cause

The root cause is missing authorization enforcement on server-side lookups keyed by the ltid query parameter. The script trusts the client-supplied identifier and issues a database query without cross-checking the record owner against the authenticated session, or without requiring authentication at all.

Attack Vector

The attack is initiated remotely over the network with no authentication and no user interaction required. An attacker sends a crafted HTTP request to /blms/view-assign-locker.php while iterating values of ltid to enumerate locker assignment records. Because the exploit is publicly documented, low-skill attackers can reproduce the request pattern using standard HTTP tooling.

The vulnerability mechanism is documented in the GitHub Issue Discussion and cataloged in the VulDB Vulnerability Details. No verified proof-of-concept code is reproduced here; refer to the referenced advisories for technical specifics.

Detection Methods for CVE-2026-90517

Indicators of Compromise

HTTP requests to /blms/view-assign-locker.php containing unusual, sequential, or brute-forced ltid parameter values.
Access to the endpoint from unauthenticated sessions or from IP addresses without a corresponding successful login event.
Elevated request volumes to view-assign-locker.php from a single source over a short time window, indicating enumeration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /blms/* and flag parameter tampering or high-cardinality ltid values from a single client.
Correlate application access logs with authentication logs to identify requests to sensitive endpoints that lack a preceding session establishment.
Baseline normal ltid request patterns per authenticated user and alert on out-of-profile access.

Monitoring Recommendations

Forward web server access logs to a centralized analytics platform for enumeration pattern analysis.
Alert on HTTP 200 responses to view-assign-locker.php where the requesting session ID is null or unrecognized.
Track outbound response sizes on the endpoint to identify bulk data retrieval consistent with record scraping.

How to Mitigate CVE-2026-90517

Immediate Actions Required

Restrict network access to the PHPGurukul Bank Locker Management System interface using firewall rules or IP allowlisting until a fix is applied.
Require authenticated sessions for all /blms/ endpoints at the reverse proxy or web server layer.
Review web server logs for prior enumeration of view-assign-locker.php and audit any exposed locker assignment data.

Patch Information

At the time of publication, no vendor patch has been referenced in the advisory. Monitor the PHP Gurukul site and the VulDB CVE Report for a fixed release. Organizations that maintain custom deployments should modify view-assign-locker.php to validate that the session user owns the record referenced by ltid before returning any data.

Workarounds

Add server-side authorization checks that verify session ownership of the requested ltid value before rendering the response.
Place the application behind an authenticating reverse proxy so that unauthenticated requests never reach /blms/view-assign-locker.php.
Implement WAF signatures that block requests to the endpoint containing suspicious or sequentially incremented ltid values.
Where the locker management functionality is not required externally, remove public exposure and limit access to an internal management VLAN.

bash

# Configuration example: Apache access restriction for the affected endpoint
<Location "/blms/view-assign-locker.php">
    Require valid-user
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>