Cyber Posture

CVE-2026-3762

HighPublic PoC

Published: 08 March 2026

Published
08 March 2026
Modified
09 March 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0002 5.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3762 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Lerouxyxchire Client Database Management System. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-285 CWE-266

Documented procedures facilitate correct implementation and ongoing management of authorization decisions.

addresses: CWE-285 CWE-266

Periodic reviews identify and correct flaws in authorization decisions or enforcement.

addresses: CWE-285 CWE-266

Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.

addresses: CWE-266 CWE-285

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

addresses: CWE-266 CWE-285

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

addresses: CWE-285

The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.

addresses: CWE-285

Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.

addresses: CWE-285

Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote exploitation of improper authorization in a public-facing web application endpoint (/superadmin_delete_manager.php) via parameter manipulation, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in SourceCodester Client Database Management System 1.0/3.1. Impacted is an unknown function of the file /superadmin_delete_manager.php of the component Endpoint. The manipulation of the argument manager_id leads to improper authorization. It is possible to initiate…

more

the attack remotely. The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2026-3762 is an improper authorization vulnerability affecting SourceCodester Client Database Management System versions 1.0 and 3.1. The flaw resides in an unknown function within the file /superadmin_delete_manager.php of the Endpoint component, where manipulation of the manager_id argument circumvents authorization controls. Published on 2026-03-08, it is associated with CWEs-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization), earning a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction required. By manipulating the manager_id parameter, attackers gain unauthorized access to delete or manage endpoints, resulting in low-level impacts to confidentiality, integrity, and availability.

VulDB advisories (ctiid.349740, id.349740, submit.768122) detail the issue and recent submission, while a proof-of-concept exploit is publicly disclosed on GitHub at https://gist.github.com/Adarshh-A/1aae387a3cf4ea05c871ddafc64d0348. The vendor site at https://www.sourcecodester.com/ hosts the affected software, where security practitioners should check for patches or updates.

Details

CWE(s)

Affected Products

lerouxyxchire
client database management system
1.0

CVEs Like This One

CVE-2026-3734Same product: Lerouxyxchire Client Database Management System
CVE-2026-3764Same product: Lerouxyxchire Client Database Management System
CVE-2026-4617Shared CWE-266, CWE-285
CVE-2026-6105Shared CWE-266, CWE-285
CVE-2025-0484Shared CWE-266, CWE-285
CVE-2025-2360Shared CWE-266, CWE-285
CVE-2026-1597Shared CWE-266, CWE-285
CVE-2026-3724Shared CWE-266, CWE-285
CVE-2026-5642Shared CWE-266, CWE-285
CVE-2025-8756Shared CWE-266, CWE-285

References