CVE-2026-14690: SourceCodester Multi-Vendor Grocery System Authorization Bypass

Technical summary

CVE-2026-14690 is an improper authorization vulnerability (CWE-266, CWE-285) affecting the save_users function in SourceCodester's Multi-Vendor Online Grocery Management System 1.0. The flaw permits attackers to manipulate user account operations through network access, bypassing the intended privilege checks. The vulnerability scores 7.3 CVSS v3.1 (HIGH severity) with a network attack vector, low complexity, no privileges required, and no user interaction needed. Impact includes confidentiality, integrity, and availability compromise.

Business impact

Organizations running SourceCodester Multi-Vendor Online Grocery Management System 1.0 face direct risk to user account integrity and confidential data exposure. Attackers can create unauthorized user accounts, modify existing ones, or escalate privileges, potentially enabling fraud, unauthorized access to customer or vendor information, and system manipulation. E-commerce and supply chain operations dependent on this system could experience service disruption and reputational damage. The public availability of exploit code significantly increases the window of vulnerability exposure.

Affected systems

SourceCodester Multi-Vendor Online Grocery Management System version 1.0 is confirmed vulnerable. Organizations must audit their deployments to confirm whether they are running this specific version. The vulnerability affects the core user management functionality, meaning any instance with user provisioning exposed to network access is at risk.

Exploitability

This vulnerability is highly exploitable. The network attack vector, combined with low attack complexity and no authentication requirement, means a remote attacker can exploit it with minimal barriers. Public exploit availability significantly lowers the technical barrier to entry for threat actors. No user interaction is required, making automated exploitation straightforward. The severity and exploitability profile suggest active exploitation is probable.

Remediation

Immediate patching is the primary remediation pathway. Contact SourceCodester for an updated version addressing the authorization flaw in the save_users function. Until patches are available and deployed, implement network segmentation to restrict access to the affected system, disable user management features if operationally feasible, and enforce additional authentication layers outside the application. Review user account logs for signs of unauthorized modifications.

Patch guidance

Obtain and deploy the latest security update from SourceCodester addressing CVE-2026-14690. Verify the patch against the vendor's official security advisory to confirm the save_users function authorization logic has been corrected. Test the patched version in a non-production environment before rolling out enterprise-wide. Given the public exploit availability and HIGH CVSS score, prioritize patch deployment within your change management cycle.

Detection guidance

Monitor the classes/Users.php file for unauthorized access or modification attempts. Look for unexpected user account creation or privilege changes in application logs. Network-level detection should capture attempts to invoke the save_users function with abnormal parameters or from untrusted sources. Inspect HTTP requests to the affected endpoint for suspicious payloads. Review user account audit trails for accounts created or modified outside normal administrative workflows.

Why prioritize this

This vulnerability merits immediate attention due to the combination of HIGH CVSS score (7.3), network exploitability, public exploit availability, and direct impact on user account security. The lack of authentication requirements means any internet-exposed instance is at severe risk. Organizations running version 1.0 should treat this as a critical security incident requiring rapid response.

Risk score, explained

The 7.3 CVSS v3.1 HIGH score reflects the severity of the authorization bypass combined with the ease of exploitation. The network attack vector (AV:N) and lack of privilege or user interaction requirements (PR:N, UI:N) ensure widespread exposure potential. Confidentiality, integrity, and availability are all compromised (C:L, I:L, A:L), indicating multi-faceted impact. Public exploit availability elevates practical risk beyond the base CVSS metric.

Frequently asked questions