CVE-2026-3734
Published: 08 March 2026
Summary
CVE-2026-3734 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Lerouxyxchire Client Database Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Deeper analysis
CVE-2026-3734 is an improper authorization vulnerability in SourceCodester Client Database Management System 1.0, affecting an unknown function in the file /fetch_manager_details.php within the Endpoint component. The flaw is triggered by manipulation of the manager_id argument, leading to authorization bypass. It was published on 2026-03-08 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is linked to CWEs-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization).
The vulnerability enables remote exploitation without authentication, privileges, or user interaction, requiring only low attack complexity. An attacker can manipulate the manager_id parameter to bypass authorization controls, potentially achieving low-level impacts on confidentiality, integrity, and availability.
Advisories are detailed on VulDB at https://vuldb.com/?ctiid.349712, https://vuldb.com/?id.349712, and https://vuldb.com/?submit.767227, with a proof-of-concept exploit available at https://gist.github.com/Adarshh-A/f25452a4fe736babd39b9a1b800e98d0. The vendor site is https://www.sourcecodester.com/. No patches are specified in the available information.
The exploit has been published and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10237
Vulnerability details
A flaw has been found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /fetch_manager_details.php of the component Endpoint. This manipulation of the argument manager_id causes improper authorization. The attack can be initiated remotely.…
more
The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct improper authorization vulnerability in a public-facing web endpoint (/fetch_manager_details.php) allowing remote unauthenticated exploitation via parameter manipulation (manager_id), which precisely matches the definition of T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions on the manager_id parameter in fetch_manager_details.php, blocking the unauthorized access that defines CVE-2026-3734.
Limits the privileges assignable via manager_id so that even a bypassed check yields only minimal data exposure rather than the observed C/I/A impacts.
Requires explicit, reliable access-control decisions for each manager_id request instead of the missing or flawed check that enables the remote bypass.