This vulnerability arises in the PHPGurukul News Portal 1.0, specifically affecting the add‑subadmins.php handler. The function is missing proper authorization checks, allowing any authenticated or unauthenticated user to create or modify sub‑admin accounts. The flaw represents Broken Authorization (CWE‑266 and CWE‑285) and could be used to elevate privileges, compromising the confidentiality and integrity of the system.

The affected product is PHPGurukul News Portal version 1.0. According to the vendor registry and CPE data, only this version is presently affected; no other releases have been identified as vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via remote web requests to the add‑subadmins.php script, potentially gaining sub‑admin or greater privileges. The available information does not indicate denial of service or remote code execution capabilities, but the continuation of the vulnerability could lead to unauthorized account creation and privilege escalation.