# CVE-2026-78144: code-projects Barangay Resident Profiling Management System authorization bypass in boarder management

Source: https://junglewise.ai/threats/cve-2026-78144-code-projects-barangay-resident-profiling-management-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78144 · Severity: medium · CVSS 6.3 · Published 2026-08-23

Barangay Resident Profiling Management System is a PHP-based application used to manage and profile residents in a barangay (village). An authorization flaw allows any logged-in user to view, modify, archive, or permanently delete resident records belonging to other users by manipulating a numeric ID parameter, exposing sensitive demographic data and enabling data tampering or destruction without proper access controls.

Technologies: [Code-Projects Barangay Resident Profiling Management System](https://junglewise.ai/threats/technologies/barangay-resident-profiling-management-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-78144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78144 being exploited in the wild.

**How severe is CVE-2026-78144?** Medium severity, with a CVSS score of 6.3, published 23 August 2026.

**Which products and versions are affected?** Code-Projects Barangay Resident Profiling Management System 1.0.

**Is there a fix for CVE-2026-78144?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78144 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78144?** Check whether you run Code-Projects Barangay Resident Profiling Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) / Broken Access Control vulnerability exists in the boarder management module (/boarders.php) where user-controlled ID parameters in GET and POST requests are processed without object-level authorization checks. The application verifies only that a user is logged in via check_login() but does not validate whether the requesting user is authorized to access or modify the specific boarder record. Attackers authenticated as any non-administrative user can craft requests with sequential numeric IDs to read, update (archive/restore), or permanently delete arbitrary resident records. State-changing operations are exposed via GET requests without CSRF protection or password confirmation. The vulnerability is unauthenticated-optional but requires valid session cookies; no public patch is currently available.

## Affected products

- code-projects Barangay Resident Profiling Management System 1.0

## Timeline

- 2026-07-07: disclosed: Public disclosure on GitHub Gist
- 2026-08-23: other: CVE-2026-78144 published

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237](https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237)

## Related threats

- [code-projects Barangay Resident Profiling Management System SQL injection in resident search](https://junglewise.ai/threats/cve-2026-78143-code-projects-barangay-resident-profiling-management-system-sql)
- [Barangay Resident Profiling Management System authorization bypass in archived records](https://junglewise.ai/threats/cve-2026-78142-barangay-resident-profiling-management-system-authorization)