Is CVE-2026-108948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108948 being exploited in the wild.

How severe is CVE-2026-108948?

Medium severity, with a CVSS score of 5.4, published 13 October 2026.

Which products and versions are affected?

Code-Projects Online Reviewer System 1.0.

Is there a fix for CVE-2026-108948?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108948 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108948?

Check whether you run Code-Projects Online Reviewer System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108948: code-projects Online Reviewer System privilege escalation via mass assignment

CVE-2026-108948 · Severity: medium · CVSS 5.4 · Published 2026-10-13

Online Reviewer System is a web-based platform for managing user accounts and roles. A flaw in the user profile update function allows any authenticated user to escalate their privileges to administrator by manipulating a hidden parameter, granting them full control of the system and access to sensitive administrative functions.

Vendors: Code-Projects.

Quick answers

Is CVE-2026-108948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108948 being exploited in the wild.
How severe is CVE-2026-108948?: Medium severity, with a CVSS score of 5.4, published 13 October 2026.
Which products and versions are affected?: Code-Projects Online Reviewer System 1.0.
Is there a fix for CVE-2026-108948?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108948 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108948?: Check whether you run Code-Projects Online Reviewer System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw caused by missing authorization checks and mass assignment in the btn_functions.php endpoint. When processing user profile updates via POST, the application directly accepts and applies the usertype_id parameter from user input without verifying that the requester is an administrator. An authenticated attacker can inject usertype_id=1 to reassign their role in the database, bypassing access control entirely.

Affected products

code-projects Online Reviewer System 1.0

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.