Is CVE-2026-86293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86293 being exploited in the wild.

How severe is CVE-2026-86293?

Medium severity, with a CVSS score of 6.5, published 7 September 2026.

Which products and versions are affected?

SourceCodester Simple Traffic Offense System 1.0.

Is there a fix for CVE-2026-86293?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86293 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86293?

Check whether you run SourceCodester Simple Traffic Offense System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86293: SourceCodester Simple Traffic Offense System auth bypass in delete endpoints

CVE-2026-86293 · Severity: medium · CVSS 6.5 · Published 2026-09-07

SourceCodester Simple Traffic Offense System is a web-based application for managing traffic offenses and user accounts. The system fails to authenticate deletion requests, allowing attackers to remotely delete user accounts and offense records without logging in, resulting in unauthorized data loss and system integrity compromise.

Technologies: SourceCodester Simple Traffic Offense System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-86293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86293 being exploited in the wild.
How severe is CVE-2026-86293?: Medium severity, with a CVSS score of 6.5, published 7 September 2026.
Which products and versions are affected?: SourceCodester Simple Traffic Offense System 1.0.
Is there a fix for CVE-2026-86293?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86293 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86293?: Check whether you run SourceCodester Simple Traffic Offense System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The application contains a critical authentication bypass in the delete-user.php and delete-offence.php endpoints. Both endpoints accept GET requests with an id parameter and perform destructive record deletion without validating server-side authentication or authorization. An unauthenticated attacker can craft a direct GET request to these endpoints (e.g., /Trafic/delete-user.php?id=1) and successfully delete records even without a valid session cookie. The vulnerability stems from missing CWE-306 (missing authentication for critical function) and CWE-862 (missing authorization) controls. An attacker needs only network access and knowledge of valid record IDs; no authentication or user interaction is required. The exploitation results in unauthorized deletion of user accounts and offense data.

Affected products

SourceCodester Simple Traffic Offense System 1.0

Timeline

2026-07-27: disclosed: Vulnerability disclosed on GitHub
2026-09-07: advisory: CVE-2026-86293 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.