Executive brief
The CodeAstro Complaint Management System, a platform used for tracking and managing user grievances, contains a security flaw in its report handling component. An unauthorized person can remotely delete any complaint report and its associated files from the system without needing a password. This can lead to permanent loss of important data and disrupt the organization's ability to track and resolve customer or employee complaints.
Technical details
An authorization bypass vulnerability exists in CodeAstro Complaint Management System 1.0 within the 'deletereport' function of 'application/controllers/Report.php'. The application fails to perform authentication or authorization checks before processing deletion requests at the Report Endpoint. A remote, unauthenticated attacker can exploit this by sending a crafted request (typically a GET request) containing a specific report identifier. Successful exploitation allows the attacker to permanently delete arbitrary reports and their associated uploaded files from the server. While some sources suggest a higher severity, the official NVD-linked CVSS score is 5.4. Public exploit code has been released.
Affected products
- CodeAstro Complaint Management System 1.0
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory