Improper Authorization Vulnerability in Neethuharii CafeManagement Software
CVE-2026-96556

6.9MEDIUM

Key Information:

Vendor

Neethuharii

Status
Cafemanagement
Vendor
CVE Published:
23 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-96556?

A significant flaw has been identified in Neethuharii CafeManagement, specifically within the addcashier function of the AddCashierCode.php file. This vulnerability arises from the manipulation of parameters such as uname, pass, role, and status, potentially leading to unauthorized access. Attackers can exploit this weakness remotely, making it a critical risk for users of the system. Despite the timely notification of the vendor regarding this issue, no response has been recorded. Organizations using this software should take immediate action to assess their risk and implement necessary safeguards.

Affected Version(s)

CafeManagement 5f743043a9a04f903678697f061d2e220e544c09

CafeManagement 66c837020e25af4866cb69b23ec3af4e0e1510c9

CafeManagement f80fe4442d5e15af5c78df3f22177a131c1e6f32

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-96556 - Proof of Concept

References

https://vuldb.com/vuln/408959
vdb-entrytechnical-description
https://vuldb.com/vuln/408959/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-96556
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yashkumar Keral (VulDB User)
VulDB CNA Team
.