Improper authorization in the /superadmin_user_delete.php endpoint of SourceCodester Client Database Management System 1.0 permits manipulation of the user_id parameter to delete arbitrary user accounts. This flaw can lead to unauthorized data loss and it maps to CWE-266 and CWE-285.

The vulnerability affects SourceCodester’s Client Database Management System version 1.0, specifically the superadmin_user_delete.php component of the Endpoint directory. No other variants or versions are listed as affected.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score of less than 1 % denotes a low current exploitation probability and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities list. The description states the attack may be performed from remote; the flaw indicates improper authorization, meaning an attacker lacking sufficient privileges could delete accounts, though it is not clear whether authentication is required. An exploit has already been published, so the risk remains moderate with low likelihood of exploitation.