# CVE-2026-90517: PHPGurukul Bank Locker Management System authentication bypass

Source: https://junglewise.ai/threats/cve-2026-90517-phpgurukul-bank-locker-management-system-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90517 · Severity: medium · CVSS 5.3 · Published 2026-09-13

The PHPGurukul Bank Locker Management System is a PHP-based web application used to manage customer locker assignments and sensitive banking records. A missing authentication check in the view-assign-locker.php page allows unauthenticated attackers to directly access and download complete customer records including full names, email addresses, phone numbers, home addresses, identity documents, and photographs by simply changing a numeric ID parameter in the URL.

Technologies: [Phpgurukul Bank Locker Management System](https://junglewise.ai/threats/technologies/bank-locker-management-system). Vendors: [Phpgurukul](https://junglewise.ai/threats/vendors/phpgurukul).

## Quick answers

**Is CVE-2026-90517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90517 being exploited in the wild.

**How severe is CVE-2026-90517?** Medium severity, with a CVSS score of 5.3, published 13 September 2026.

**Which products and versions are affected?** Phpgurukul Bank Locker Management System 1.0.

**Is there a fix for CVE-2026-90517?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90517 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90517?** Check whether you run Phpgurukul Bank Locker Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability caused by a missing session validation check in the /blms/view-assign-locker.php file. The vulnerable component accepts a GET parameter (ltid) and directly queries the database to render sensitive customer personally identifiable information (PII) without verifying the user's session. While other protected pages in the application implement if(strlen($_SESSION['aid'])==0) guards, this particular page omits the check entirely. The attack requires only network access and no authentication credentials; attackers can enumerate all customer records by incrementing the sequential integer ltid parameter and directly access uploaded identity documents and photographs from unprotected directories (banker/addressproof/ and banker/photo/).

## Affected products

- PHPGurukul Bank Locker Management System 1.0

## Timeline

- 2026-09-13: disclosed
- 2026-07-31: other: Vulnerability confirmed through source code analysis and live deployment verification

## References

- [https://github.com/wakakakaaaaha/vuln/issues/2](https://github.com/wakakakaaaaha/vuln/issues/2)
- [https://phpgurukul.com/](https://phpgurukul.com/)

## Related threats

- [PHPGurukul Bank Locker Management System unrestricted file upload](https://junglewise.ai/threats/cve-2026-90519-phpgurukul-bank-locker-management-system-unrestricted-file-upload)
- [PHPGurukul Bank Locker Management System privilege escalation](https://junglewise.ai/threats/cve-2026-90518-phpgurukul-bank-locker-management-system-privilege-escalation)
- [PHPGurukul Bank Locker Management System session hijacking in change-password.php](https://junglewise.ai/threats/cve-2025-50491-phpgurukul-bank-locker-management-system-session-hijacking-in)