CVE-2026-13549
CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 29, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 28, 2026
Description
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.4 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Complaint Management SystemCodeAstro |
|
References
- VDB-374557 | CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorizationvdb-entrytechnical-description
- VDB-374557 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-13549 | CVE Analysis and Reportthird-party-advisory
- Submit #843260 | CodeAstro Complaint Management System v1.0 Insecure Direct Object Reference (IDOR)third-party-advisory
- https://github.com/ashikmd0507/CVE/tree/main/Unauthenticated%20Arbitrary%20Report%20%26%20File%20Deletionexploit
- https://codeastro.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.