An improper authorization flaw exists in the Admin-Register-inc.php script of the Insurance-Management-System. By manipulating the submit/Admin_id/password parameter, an unauthenticated user can create or register a new administrator, enabling unauthorized access to privileged functions and compromising confidentiality, integrity, and availability. The weakness is identified as CWE-266 (Privilege Escalation) and CWE-285 (Improper Authorization).

The vulnerable code is part of the dhikshitha29 Insurance-Management-System. No explicit version information is provided because the repository follows a rolling release model, so any deployed instance may be affected. The source is hosted on GitHub, where the issue was initially reported.

The CVSS score of 6.9 reflects moderate severity, and while the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, the public exploit is available and can be executed remotely. Attackers require only the ability to submit a crafted request to the admin registration endpoint, making exploitation straightforward without additional prerequisites.