The vulnerability is located in the admin/user.php module of SourceCodester Pet Grooming Management Software 1.0. By altering the group_id parameter the attacker can bypass normal authorization checks. The result is that a non‑privileged user could gain elevated permissions or access sensitive user data. This type of flaw is a classic example of improper authorization, classified under CWE‑266 and CWE‑285.

SourceCodester Pet Grooming Management Software version 1.0, delivered under the /admin/operation/user.php path. The flaw is present only in this specific released version; no other versions have been identified as affected.

The vulnerability scores a CVSS of 5.3, indicating moderate impact, and an EPSS below 1 %, implying a low likelihood of exploitation. It is not listed in CISA’s KEV, but the existence of a publicly known exploit raises concern. The attack can be initiated remotely via a web request, making it accessible from any machine that can reach the application. If exploited, the attacker could impersonate higher‑privileged roles, potentially compromising confidential data or manipulating business processes.