CVE-2026-90565 Overview
CVE-2026-90565 is an improper access control vulnerability [CWE-266] in the Rizwan17 inventory-management-system project on GitHub. The flaw resides in an unknown function within dashboard.php, where manipulation of the userid parameter bypasses access controls. Attackers can trigger the issue remotely without authentication or user interaction. A public exploit has been released, increasing exposure for deployed instances. Because the project uses a rolling release model, no fixed version identifiers are published, and the maintainer has not responded to the initial issue report. Organizations running this open-source inventory application should treat the exposure as active until access controls around dashboard.php are hardened.
Critical Impact
Remote, unauthenticated manipulation of the userid parameter in dashboard.php allows attackers to bypass access controls and view or interact with data belonging to other users.
Affected Products
- Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f
- All rolling-release builds prior to any future maintainer fix
- Deployments exposing dashboard.php to untrusted networks
Discovery Timeline
- 2026-09-13 - CVE-2026-90565 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90565
Vulnerability Analysis
The vulnerability is an improper access control flaw [CWE-266] triggered through the userid parameter accepted by dashboard.php. The application trusts the client-supplied userid value to determine which account context to load, rather than deriving it from an authenticated session. By substituting another user's identifier, an attacker reaches records and functionality that should be restricted to that user. The exploit has been disclosed publicly, and the attack requires no authentication, no privileges, and no user interaction. The maintainer was notified through a GitHub issue but has not published a response or patch.
Root Cause
The root cause is reliance on a client-controlled identifier for authorization decisions inside dashboard.php. The affected function does not validate that the requesting session owns or has rights to the specified userid. This is a classic insecure direct object reference pattern classified under CWE-266 (Incorrect Privilege Assignment).
Attack Vector
Exploitation occurs over the network against the HTTP interface of the application. An attacker sends a crafted request to dashboard.php with a userid value belonging to a different account. The server processes the request in the target user's context and returns data or performs actions accordingly. No credentials or prior access are required.
No verified proof-of-concept code is republished here. Technical discussion is available in the GitHub Issue #15 Discussion and the VulDB CVE-2026-90565 advisory.
Detection Methods for CVE-2026-90565
Indicators of Compromise
- HTTP requests to dashboard.php containing userid values that do not match the authenticated session identifier.
- Repeated sequential or enumerated userid parameter values from a single client IP address.
- Access log entries showing account data retrievals not preceded by a corresponding login event for that account.
Detection Strategies
- Deploy web application firewall rules that compare the submitted userid parameter against the session-bound user identifier and block mismatches.
- Instrument application logs to record every access to dashboard.php with both the session user and the userid argument for correlation.
- Hunt for anomalous horizontal access patterns where one session touches many distinct userid values in a short interval.
Monitoring Recommendations
- Forward web server and PHP application logs to a centralized analytics platform and alert on userid parameter tampering.
- Baseline normal per-user request rates against dashboard.php and alert on statistical outliers.
- Monitor egress volumes from the application server for unexpected spikes that may indicate bulk data extraction.
How to Mitigate CVE-2026-90565
Immediate Actions Required
- Restrict network access to the inventory-management-system deployment using firewall rules or VPN-only exposure until a patch is available.
- Apply a virtual patch at the reverse proxy or WAF that rejects any request to dashboard.php where the userid parameter does not equal the session-bound user identifier.
- Review historical access logs for prior exploitation attempts against dashboard.php.
Patch Information
No official patch is available. The project uses a rolling release model, and the maintainer has not responded to the reported issue. Organizations should track the GitHub Inventory Management System repository and the GitHub Issue #15 Discussion for future updates. In the interim, apply the source-level fix described in the workarounds section.
Workarounds
- Modify dashboard.php to derive the acting user identifier from the server-side session rather than the userid request parameter.
- Add an authorization check that verifies the session user has rights to any requested userid before returning data.
- If the application is not business-critical, take the deployment offline until a validated fix is in place.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.