# CVE-2026-90566: Rizwan17 inventory-management-system privilege escalation in registration

Source: https://junglewise.ai/threats/cve-2026-90566-rizwan17-inventory-management-system-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90566 · Severity: high · CVSS 7.3 · Published 2026-09-13

Rizwan17's inventory management system is a web application used for managing product inventory and user accounts. An unauthenticated attacker can register a new user account and assign themselves an "Admin" role without authorization, gaining full administrative access to the system. This allows complete compromise of the application and any business data stored within it.

## Quick answers

**Is CVE-2026-90566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90566 being exploited in the wild.

**How severe is CVE-2026-90566?** High severity, with a CVSS score of 7.3, published 13 September 2026.

**Which products and versions are affected?** Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.

**Is there a fix for CVE-2026-90566?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90566 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90566?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authorization flaw in the registration handler component (register.php and includes/process.php). The createUserAccount() function in includes/user.php accepts a client-controlled "usertype" parameter from POST data without validation, allowing an unauthenticated attacker to register a new account and set the usertype to "Admin" instead of being restricted to the least-privileged "Other" role. An attacker can submit a registration request with usertype=Admin to gain immediate administrative access. The vulnerability requires network access and no authentication or user interaction, making it trivially exploitable. Proof-of-concept exploitation has been publicly disclosed, allowing direct admin account creation and full system compromise.

## Affected products

- Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

## Timeline

- 2026-08-01: disclosed
- 2026-09-13: other: CVE published

## References

- [http://github.com/Rizwan17/inventory-management-system/issues/16](http://github.com/Rizwan17/inventory-management-system/issues/16)
- [https://vuldb.com/cve/CVE-2026-90566](https://vuldb.com/cve/CVE-2026-90566)