Quick answers
- Is CVE-2026-105170 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105170 being exploited in the wild.
- How severe is CVE-2026-105170?
- High severity, with a CVSS score of 7.3, published 5 October 2026.
- Which products and versions are affected?
- Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier.
- Is there a fix for CVE-2026-105170?
- No fixed version is recorded yet. Remove the public-facing admin registration page and implement admin provisioning only through a trusted CLI or backend console. Add mandatory authentication and role-based authorization checks before any admin operation, and require offline vetting and approval for any NGO registration flow.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-09","note":"Issue reported on GitHub"},{"kind":"advisory","at":"2026-10-05","note":"CVE-2026-105170 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-105170 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105170?
- Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Remove the public-facing admin registration page and implement admin provisioning only through a trusted CLI or backend console. Add mandatory authentication and role-based authorization checks before any admin operation, and require offline vetting and approval for any NGO registration flow.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-09","note":"Issue reported on GitHub"},{"kind":"advisory","at":"2026-10-05","note":"CVE-2026-105170 published"}]
Technical details
The admin/signup.php endpoint lacks authentication checks or authorization gates before creating administrator accounts. An unauthenticated attacker can POST to this endpoint with arbitrary credentials (username, email, password, location, address) and the application directly inserts them into the admin database table. Upon signin, the attacker obtains an admin session that passes all role checks in downstream pages (admin/admin.php, admin/donate.php, etc.), gaining complete platform control and access to PII.
Affected products
- kishor-23 food-waste-management-system commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier