Is CVE-2026-78144 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78144 being exploited in the wild.

How severe is CVE-2026-78144?

Medium severity, with a CVSS score of 6.3, published 23 August 2026.

Is there a fix for CVE-2026-78144?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78144 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78144?

Check whether you run Code-Projects Barangay Resident Profiling Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78144: code-projects Barangay Resident Profiling Management System authorization bypass in boarder management

CVE-2026-78144 · Severity: medium · CVSS 6.3 · Published 2026-08-23

Barangay Resident Profiling Management System is a PHP-based application used to manage and profile residents in a barangay (village). An authorization flaw allows any logged-in user to view, modify, archive, or permanently delete resident records belonging to other users by manipulating a numeric ID parameter, exposing sensitive demographic data and enabling data tampering or destruction without proper access controls.

Technologies: Code-Projects Barangay Resident Profiling Management System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-78144 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78144 being exploited in the wild.
How severe is CVE-2026-78144?: Medium severity, with a CVSS score of 6.3, published 23 August 2026.
Which products and versions are affected?: Code-Projects Barangay Resident Profiling Management System 1.0.
Is there a fix for CVE-2026-78144?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78144 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78144?: Check whether you run Code-Projects Barangay Resident Profiling Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) / Broken Access Control vulnerability exists in the boarder management module (/boarders.php) where user-controlled ID parameters in GET and POST requests are processed without object-level authorization checks. The application verifies only that a user is logged in via check_login() but does not validate whether the requesting user is authorized to access or modify the specific boarder record. Attackers authenticated as any non-administrative user can craft requests with sequential numeric IDs to read, update (archive/restore), or permanently delete arbitrary resident records. State-changing operations are exposed via GET requests without CSRF protection or password confirmation. The vulnerability is unauthenticated-optional but requires valid session cookies; no public patch is currently available.

Affected products

code-projects Barangay Resident Profiling Management System 1.0

Timeline

2026-07-07: disclosed: Public disclosure on GitHub Gist
2026-08-23: other: CVE-2026-78144 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.