Vulnerability · Published Mar 8, 2026 · Assigned by VulDB

CVE-2026-3761SourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization

Medium 5.4

In plain English

A medium-severity security flaw in Client Database Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /superadmin_user_delete.php of the component Endpoint. Executing a manipulation of the argument user_id can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Client Database Management System	1.0

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-349739 | SourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization vdb-entry, technical-description
VDB-349739 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #768120 | SourceCodester Client Database Management System (CDMS) 1.0 Improper Authorization third-party-advisory
https://gist.github.com/Adarshh-A/dd8884d768d9dde9072fe5efce453824 exploit
https://www.sourcecodester.com/ product