The identified flaw exists in the Users.php save handler of SourceCodester Water Billing Management System 1.0. Manipulating the request to this endpoint bypasses authorization checks, allowing an attacker to perform actions as an administrator or modify user accounts. This violation of access control is classified as a privilege escalation vulnerability (CWE‑266) and broken access control (CWE‑285). The result is an unauthorized elevation of privileges that compromises the confidentiality and integrity of the system.

This weakness targets the Water Billing Management System supplied by SourceCodester. All installations running version 1.0 (and any earlier builds extending /classes/Users.php?f=save) are potentially affected. The vulnerability resides in the file /classes/Users.php within the User Management component, which handles user creation and updates.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, but the public disclosure and availability of an exploit script suggest that the risk of exploitation is non‑zero. The vulnerability can be triggered remotely via the web interface and is not limited to local attackers. Because the flaw permits unauthorized privilege escalation, it is listed as a known vulnerability, though it is not yet included in the CISA KEV catalog.