Is CVE-2026-90517 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90517 being exploited in the wild.

How severe is CVE-2026-90517?

Medium severity, with a CVSS score of 5.3, published 13 September 2026.

Which products and versions are affected?

Phpgurukul Bank Locker Management System 1.0.

Is there a fix for CVE-2026-90517?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90517 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90517?

Check whether you run Phpgurukul Bank Locker Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90517: PHPGurukul Bank Locker Management System authentication bypass

CVE-2026-90517 · Severity: medium · CVSS 5.3 · Published 2026-09-13

The PHPGurukul Bank Locker Management System is a PHP-based web application used to manage customer locker assignments and sensitive banking records. A missing authentication check in the view-assign-locker.php page allows unauthenticated attackers to directly access and download complete customer records including full names, email addresses, phone numbers, home addresses, identity documents, and photographs by simply changing a numeric ID parameter in the URL.

Technologies: Phpgurukul Bank Locker Management System. Vendors: Phpgurukul.

Quick answers

Is CVE-2026-90517 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90517 being exploited in the wild.
How severe is CVE-2026-90517?: Medium severity, with a CVSS score of 5.3, published 13 September 2026.
Which products and versions are affected?: Phpgurukul Bank Locker Management System 1.0.
Is there a fix for CVE-2026-90517?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90517 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90517?: Check whether you run Phpgurukul Bank Locker Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authentication bypass vulnerability caused by a missing session validation check in the /blms/view-assign-locker.php file. The vulnerable component accepts a GET parameter (ltid) and directly queries the database to render sensitive customer personally identifiable information (PII) without verifying the user's session. While other protected pages in the application implement if(strlen($_SESSION['aid'])==0) guards, this particular page omits the check entirely. The attack requires only network access and no authentication credentials; attackers can enumerate all customer records by incrementing the sequential integer ltid parameter and directly access uploaded identity documents and photographs from unprotected directories (banker/addressproof/ and banker/photo/).

Affected products

PHPGurukul Bank Locker Management System 1.0

Timeline

2026-09-13: disclosed
2026-07-31: other: Vulnerability confirmed through source code analysis and live deployment verification

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.