An improper authorization check in the User Information Handler allows a remote attacker to manipulate the ID parameter and gain unauthorized access to user data. The vulnerability results in a privilege escalation where any authenticated user can view or modify other users’ information. The weakness is classified as CWE-285 and CWE-639, reflecting an incorrect permission check and an instance of unintended information disclosure through insecure direct object references.

SourceCodester:Leave Application System version 1.0 is affected by the flaw. The issue exists in the file /index.php?page=manage_user, which is part of the User Information component and allows attackers to target this component in a web application context.

The vulnerability scores a CVSS of 6.9, indicating a moderate to high severity. No EPSS data is available, and it is not listed in the CISA KEV catalog, suggesting the exploitation likelihood is not formally quantified. The attack requires only remote access to the application and can be performed by sending a crafted request that modifies the ID argument. Once exploited, it enables unauthorized viewing or modification of user details, potentially exposing personal data.