Improper Authorization in Rizwan17 Inventory Management System
CVE-2026-90566

6.9MEDIUM

Key Information:

Vendor

Rizwan17

Status
Inventory-management-system
Vendor
CVE Published:
13 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90566?

A vulnerability has been identified in the Rizwan17 Inventory Management System that allows for improper authorization via the 'createUserAccount' function found in 'register.php'. This weakness occurs when the 'usertype' argument is manipulated, potentially enabling remote attackers to exploit this flaw. The issue is concerning as it poses a significant risk to user account management, and exploits have been publicly disclosed. Continuous rolling releases mean version details for affected products may not be available for review, and the project's response to this issue remains pending.

Affected Version(s)

inventory-management-system bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90566 - Proof of Concept

References

https://vuldb.com/vuln/403151
vdb-entrytechnical-description
https://vuldb.com/vuln/403151/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90566
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

sybululu (VulDB User)
VulDB CNA Team
.