CodeAstro’s QR Code Attendance Management System version 1.0 contains a flaw in the Save method of UserController.php where the role_id argument may be manipulated. This improper privilege management allows an attacker to grant themselves a higher role within the application, effectively escalating their permissions. The weakness is categorized under CWE‑266 and CWE‑269, indicating a failure to enforce correct authorization and an insecure delegation of privileges.

All installations of CodeAstro QR Code Attendance Management System with the default configuration and version 1.0 are affected. The vulnerability resides in the app/Controllers/UserController.php file and is present in the standard package distributed from the vendor’s website and public repositories.

The CVSS v3.1 score of 5.1 reflects a moderate severity. The EPSS score is unavailable, but the write‑up confirms that the exploit code is publicly available, implying that a remote actor can trigger the escalation. The vulnerability is not listed in the CISA KEV catalog, yet the existence of a public exploit raises the risk of widespread misuse if patches are not applied.