The vulnerability resides in the save_users function of SourceCodester's Multi‑Vendor Online Grocery Management System version 1.0. The code fails to perform proper authorization before creating or updating user records, allowing an attacker to add or modify users, including privileged accounts, without authentication. This flaw is a classic example of improper authorization (CWE‑285) combined with improper privilege management (CWE‑266). As a result, an attacker can gain unauthorized access or elevate privileges, potentially compromising the entire application.

Only the 1.0 release of SourceCodester Multi‑Vendor Online Grocery Management System is listed as affected; no other versions have been reported vulnerable.

The CVSS score of . The description confirms that remote exploitation is possible, likely via unauthenticated HTTP requests to the save_users endpoint. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not cataloged in the CISA KEV inventory. Nevertheless, because the flaw is exploitable without prior authentication, it presents a significant risk if not addressed.