An application-level flaw in SourceCodester Inventory System allows an attacker to manipulate the ROLE argument in the users_handler.php script, leading to improper authorization. The vulnerability permits the creation of user accounts with roles that may not be authorized, which can potentially provide elevated access depending on how the system enforces role permissions. This weakness is rooted in incorrect role validation (CWE-266, CWE-285). The likely impact—creating accounts with higher privileges—is inferred from the ability to manipulate role values; the exact privilege level depends on the system's role enforcement.

SourceCodester Inventory System version 1.0 contains a vulnerable component located at /Product_Inventory/api/users_handler.php. The vulnerability affects the account‑creation handler and may allow manipulation of role assignments during user registration.

The CVSS score of 5.3 denotes moderate severity, and the description explicitly states the attack can be performed remotely. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. However, an exploit has been publicly released, indicating that attackers may already leverage it. The vulnerability allows crafting requests to the account‑creation endpoint with arbitrary ROLE values, which could create unauthorized accounts with elevated roles.