Is CVE-2026-105171 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105171 being exploited in the wild.

How severe is CVE-2026-105171?

Medium severity, with a CVSS score of 6.3, published 5 October 2026.

Which products and versions are affected?

Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior.

Is there a fix for CVE-2026-105171?

No fixed version is recorded yet. Add a distinct role attribute to the session (e.g., $_SESSION['role']='admin') set only during admin login, and enforce role checks with exit() on all admin and delivery pages. Alternatively, centralize authorization checks in shared middleware or an included guard file to prevent bypass. [{"kind": "disclosed", "at": "2026-09-09", "note": "Vulnerability reported on GitHub issue #11"}, {"kind": "advisory", "at": "2026-10-05", "note": "CVE-2026-105171 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105171 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105171?

Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105171: Food Waste Management System authorization bypass in Role Attribute Handler

CVE-2026-105171 · Severity: medium · CVSS 6.3 · Published 2026-10-05

The Food Waste Management System is a web application that allows users to donate food and manage deliveries. A vulnerability in its role-checking mechanism allows any registered user to access and perform admin functions, including viewing sensitive donor information (names, addresses, phone numbers, feedback) and reassigning food donations. An attacker can create a free user account and immediately gain full admin privileges.

Technologies: Kishor-23 Food-Waste-Management-System. Vendors: Kishor-23.

Quick answers

Is CVE-2026-105171 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105171 being exploited in the wild.
How severe is CVE-2026-105171?: Medium severity, with a CVSS score of 6.3, published 5 October 2026.
Which products and versions are affected?: Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior.
Is there a fix for CVE-2026-105171?: No fixed version is recorded yet. Add a distinct role attribute to the session (e.g., $_SESSION['role']='admin') set only during admin login, and enforce role checks with exit() on all admin and delivery pages. Alternatively, centralize authorization checks in shared middleware or an included guard file to prevent bypass.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09", "note": "Vulnerability reported on GitHub issue #11"}, {"kind": "advisory", "at": "2026-10-05", "note": "CVE-2026-105171 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105171 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105171?: Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Add a distinct role attribute to the session (e.g., $_SESSION['role']='admin') set only during admin login, and enforce role checks with exit() on all admin and delivery pages. Alternatively, centralize authorization checks in shared middleware or an included guard file to prevent bypass.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09", "note": "Vulnerability reported on GitHub issue #11"}, {"kind": "advisory", "at": "2026-10-05", "note": "CVE-2026-105171 published"}]

Technical details

The application implements role-based access control but fails to enforce it: the admin module only checks if $_SESSION['name'] is set, without verifying the user's role. Both donor and admin logins populate the same session variable, making them indistinguishable. An attacker with a low-privilege donor account can access all admin pages (admin.php, donate.php, feedback.php, analytics.php, adminprofile.php) and perform administrative actions like reassigning food donations. The vulnerability requires authentication (a free user registration) and network access.

Affected products

kishor-23 Food Waste Management System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.