A flaw in the Action::save_user method of SourceCodester Simple Café Billing System 1.0 allows an attacker to manipulate the Type argument, resulting in unauthorized changes to user accounts. The vulnerability creates an authorization bypass that can grant elevated privileges or enable the creation of new admin users. Its impact is a loss of confidentiality, integrity, and control over user management, effectively allowing attackers to gain wider access to the system.

The vulnerable component is the Simple Café Billing System from SourceCodester, version 1.0. Any deployment of that version is affected; older or newer releases are not listed as impacted.

The CVSS score of 6.9 indicates a medium‑to‑high severity risk, and the EPSS score is not available. The vulnerability is exploitable remotely, and the attack can be launched from any machine that can reach the application's admin interface. Although it is not currently listed in the CISA KEV catalog, the fact that the exploit is publicly disclosed raises the likelihood of real‑world attacks. The overall risk remains medium but should be treated seriously, especially for systems exposed to the internet.