The vulnerability resides in the file /user/UpdateTaskStatus.php of code-projects Task Management System. By manipulating the HTTP arguments task_id and val an attacker can bypass the built‑in authorization checks, allowing the status of any task to be altered without proper permission. The flaw is classified as Missing Authorization and Improper Authorization (CWE‑862 and CWE‑863). This results in an integrity compromise, as task states can be changed arbitrarily, potentially impacting project workflows and data consistency.

The affected product is code‑projects Task Management System version 1.0. No additional affected versions are currently listed, so any installation of version 1.0 that includes the exposed UpdateTaskStatus.php endpoint is vulnerable. The vendor entry confirms the presence of this file and the lack of authorization handling for its parameters.

The CVSS score is 6.9, placing the vulnerability in the Medium severity range. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, which suggests no widespread, actively used public exploit is currently known. The attack vector is inferred to be remote, via a web request to UpdateTaskStatus.php, because the description states the exploit can be launched remotely. An unauthenticated or authenticated but unauthorized user can modify the status of any task by sending a crafted request to the vulnerable endpoint, thereby altering task workflows without permission.