Is CVE-2026-90565 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90565 being exploited in the wild.

How severe is CVE-2026-90565?

Medium severity, with a CVSS score of 5.3, published 13 September 2026.

Which products and versions are affected?

Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.

Is there a fix for CVE-2026-90565?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90565 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90565?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90565: Rizwan17 inventory-management-system auth bypass in dashboard.php

CVE-2026-90565 · Severity: medium · CVSS 5.3 · Published 2026-09-13

Rizwan17's inventory-management-system is an open-source application for managing product inventory and orders. An authentication bypass flaw allows unauthenticated attackers to access protected pages and retrieve sensitive information (internal UI structure, database records) by exploiting incomplete session checks that redirect but do not stop page execution. The vulnerability could enable attackers to perform unauthorized inventory modifications or access confidential operational data.

Quick answers

Is CVE-2026-90565 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90565 being exploited in the wild.
How severe is CVE-2026-90565?: Medium severity, with a CVSS score of 5.3, published 13 September 2026.
Which products and versions are affected?: Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.
Is there a fix for CVE-2026-90565?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90565 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90565?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw in dashboard.php and related protected pages. When an unauthenticated request arrives, the application emits a Location header redirect but does not exit execution, causing PHP to continue rendering the protected page body. Non-browser HTTP clients (e.g., curl, automated tools) receive both the redirect header and full protected content without requiring a valid session cookie. The attack is network-accessible, requires no authentication or user interaction, and allows disclosure of internal UI elements and form endpoints. The root cause is missing exit() or return statements after the header() redirect call. The project has not yet patched this issue as of the advisory publication date.

Affected products

Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

Timeline

2026-09-13: disclosed: Published on NVD
2026-08-01: other: Issue reported on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.