The vulnerability resides in the /superadmin_delete_manager.php endpoint of SourceCodester Client Database Management System. The manager_id parameter is not validated against user privileges, enabling an attacker to delete a manager record without holding superadmin rights. This flaw corresponds to CWE‑266 (Broken Access Control) and CWE‑285 (Improper Privilege Management). The direct consequence is loss of data integrity and availability for administrative records; the attacker cannot execute arbitrary code, but can remove legitimate manager accounts, potentially disrupting business processes.

The affected product is SourceCodester Client Database Management System, versions 1.0 and 3.1. The vulnerability is present in the web‑reachable endpoint of the system distributed by SourceCodester.

An attacker can exploit the flaw by sending a crafted HTTP request containing an arbitrary manager_id from any remote machine. The EPSS score is below 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in KEV. Nonetheless, the CVSS score of 6.9 reflects a moderate severity due to the potential for data removal. The attack vector is inferred to be remote via the web interface because the endpoint is publicly reachable. The impact remains confined to the deletion of manager records, which can still destabilize operations if key staff accounts are removed.