Executive brief
A security flaw has been found in the SourceCodester Ship Ferry Ticket Reservation System, a web application used for managing ferry bookings. This vulnerability allows an attacker to bypass security checks and access administrative functions or data they should not be able to see. This could lead to unauthorized changes to ticket records or exposure of sensitive reservation information.
Technical details
A vulnerability exists in SourceCodester Ship Ferry Ticket Reservation System 1.0 due to improper authorization (CWE-285) within the /admin/ directory. The flaw is triggered by manipulating the 'page' argument, which allows an authenticated user with low privileges to access administrative functions or restricted pages. An attacker can exploit this over the network to view or modify data without proper permission. Public exploit code has been released for this vulnerability. No official patch has been confirmed at this time.
Affected products
- SourceCodester Ship Ferry Ticket Reservation System 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability published to NVD
References
- https://medium.com/@hemantrajbhati5555/missing-authorization-in-sourcecodester-ship-ferry-ticket-reservation-system-leads-to-unauthorized-7783134d6596
- https://vuldb.com/cve/CVE-2026-10876
- https://vuldb.com/submit/831870
- https://vuldb.com/vuln/368366
- https://vuldb.com/vuln/368366/cti
- https://www.sourcecodester.com/