Description
A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication bypass enabling unauthorized user deletion
Action: Patch immediately
AI Analysis

Impact

The flaw lies in the delete-user.php endpoint of SourceCodester Simple Traffic Offense System 1.0. Manipulating the ID argument bypasses authentication, allowing an attacker to delete user accounts without proper credentials. This leads to loss of legitimate user data, potential denial of service for affected users, and undermines data integrity. The weakness corresponds to CWE-287 (Authentication Bypass) and CWE-306 (Missing Authentication/Authorization).

Affected Systems

SourceCodester:Simple Traffic Offense System version 1.0 is affected. No other versions are listed as vulnerable.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.9, indicating moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack can be launched remotely via an HTTP request to delete-user.php with a crafted ID value, and the exploit has already been published and used. Therefore, the likelihood of exploitation in the wild is non‑negligible, especially if the application is exposed to the internet.

Generated by OpenCVE AI on September 7, 2026 at 14:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Simple Traffic Offense System to the latest version that includes a fix for the delete-user.php authentication mechanism or apply any vendor‑issued patch.
  • If an upgrade is not immediately possible, modify the delete-user.php endpoint to enforce strict authentication and authorization checks, ensuring that only users with appropriate privileges can invoke the deletion action.
  • Restrict network access to the delete-user.php endpoint by limiting it to trusted IP ranges or internal network only, and consider configuring a web application firewall to block unauthorized access attempts.

Generated by OpenCVE AI on September 7, 2026 at 14:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used.
Title SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication
First Time appeared Sourcecodester
Sourcecodester simple Traffic Offense System
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:sourcecodester:simple_traffic_offense_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Traffic Offense System
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Traffic Offense System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:40:14.244Z

Reserved: 2026-09-06T15:54:59.238Z

Link: CVE-2026-86293

cve-icon Vulnrichment

Updated: 2026-09-08T13:40:09.631Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T10:16:55.407

Modified: 2026-09-08T14:17:34.017

Link: CVE-2026-86293

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T14:30:17Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function