CVE-2026-96556

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md cna@vuldb.com
• https://vuldb.com/cve/CVE-2026-96556 cna@vuldb.com
• https://vuldb.com/submit/898980 cna@vuldb.com
• https://vuldb.com/vuln/408959 cna@vuldb.com
• https://vuldb.com/vuln/408959/cti cna@vuldb.com

The full cvelistV5 record. Download as CVE-2026-96556.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"
          ],
          "product": "CafeManagement",
          "vendor": "Neethuharii",
          "versions": [
            {
              "status": "affected",
              "version": "5f743043a9a04f903678697f061d2e220e544c09"
            },
            {
              "status": "affected",
              "version": "66c837020e25af4866cb69b23ec3af4e0e1510c9"
            },
            {
              "status": "affected",
              "version": "f80fe4442d5e15af5c78df3f22177a131c1e6f32"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yashkumar Keral (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T20:15:07.264Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-408959 | Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/408959"
        },
        {
          "name": "VDB-408959 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/408959/cti"
        },
        {
          "name": "CVE-2026-96556 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-96556"
        },
        {
          "name": "Submit #898980 | github Cafe Management System (CafeManagement) 1.0 Missing Authentication \u2192 Unauthenticated Privileged Account Crea",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/898980"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-23T15:14:36.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-96556",
    "datePublished": "2026-09-23T20:15:07.264Z",
    "dateReserved": "2026-09-23T13:08:44.247Z",
    "dateUpdated": "2026-09-23T20:15:07.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}