# CVE-2026-109605: SourceCodester Simple Cafe Billing System improper authorization in user creation

Source: https://junglewise.ai/threats/cve-2026-109605-a-security-vulnerability-has-been-detected-in-sourcecodester  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109605 · Severity: high · CVSS 7.3 · Published 2026-10-13

SourceCodester Simple Cafe Billing System is a web-based point-of-sale and restaurant management platform. An attacker can bypass authentication to create administrator accounts without logging in, then use those credentials to access the full admin dashboard and modify users, products, categories, and orders. This grants complete control over the billing system and business data.

Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-109605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109605 being exploited in the wild.

**How severe is CVE-2026-109605?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** SourceCodester Simple Cafe Billing System 1.0.

**Is there a fix for CVE-2026-109605?** No fixed version is recorded yet. Require $_SESSION['login_id'] authentication in ajax.php for all non-public actions (only allow login and signup unauthenticated). In save_user(), never accept the 'type' parameter from POST; force type=2 (staff) on insert operations and restrict type changes to admin users only. Use prepared statements for all database queries and set display_errors=0 in production. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109605 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109605?** Check whether you run SourceCodester Simple Cafe Billing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Require $_SESSION['login_id'] authentication in ajax.php for all non-public actions (only allow login and signup unauthenticated). In save_user(), never accept the 'type' parameter from POST; force type=2 (staff) on insert operations and restrict type changes to admin users only. Use prepared statements for all database queries and set display_errors=0 in production.

## Technical details

The ajax.php router dispatches all backend actions without session validation (CWE-862). The Action::save_user() function in admin_class.php uses extract($_POST) to populate variables, then directly interpolates the attacker-controlled 'type' parameter into an SQL INSERT statement. An unauthenticated attacker sends a POST request to ajax.php?action=save_user with type=1 to create an administrator account, then logs in normally via the unguarded login action to gain full admin access.

## Affected products

- SourceCodester Simple Cafe Billing System 1.0

## Timeline

- 2026-09-25: disclosed: Vulnerability reproduced in local lab and advisory prepared

## References

- [https://tracexlabs.com/releases/billing-preauth-admin.html](https://tracexlabs.com/releases/billing-preauth-admin.html)
- [https://vuldb.com/cve/CVE-2026-109605](https://vuldb.com/cve/CVE-2026-109605)