A flaw in the delete-session.php script of the SourceCodester eDoc Doctor Appointment System allows attackers to manipulate the session identifier parameter, bypassing the built‑in authorization checks. This missing authorization can be leveraged to remove or delete any user session, effectively granting the attacker control over targeted accounts or enabling denial of service by terminating sessions. The vulnerability is cataloged with CWE-862 and CWE-863, indicating that the system fails to enforce proper authorization and access control.

The affected product is SourceCodester eDoc Doctor Appointment System version 1.0. Any deployment of this version that exposes the /admin/delete-session.php endpoint is susceptible, regardless of the underlying operating system or web server used.

The vulnerability carries a CVSS score of 6.9, representing moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the gap remotely by sending crafted requests that alter the session ID parameter. Successful exploitation would grant unauthorized access to session deletion capabilities, potentially leading to privilege escalation or denial of service in affected installations.