CVE-2026-33730

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33730
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624 Patch
https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*
History

01 Apr 2026, 15:05

Type Values Removed Values Added
First Time Opensourcepos
Opensourcepos open Source Point Of Sale
References () https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624 - () https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624 - Patch
References () https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch - () https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch - Exploit, Mitigation, Vendor Advisory
CPE cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*

30 Mar 2026, 13:26

Type Values Removed Values Added
Summary
  • (es) Open Source Point of Sale (opensourcepos) es una aplicación de punto de venta basada en la web escrita en PHP utilizando el framework CodeIgniter. Antes de la versión 3.4.2, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) permite a un usuario autenticado con bajos privilegios acceder a la funcionalidad de cambio de contraseña de otros usuarios, incluidos los administradores, manipulando el parámetro 'employee_id'. La aplicación no verifica la propiedad del objeto ni aplica comprobaciones de autorización. La versión 3.4.2 añade comprobaciones de autorización a nivel de objeto para validar que el usuario actual es propietario del 'employee_id' al que se accede.

27 Mar 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-27 01:16

Updated : 2026-04-01 15:05

NVD link : CVE-2026-33730

Mitre link : CVE-2026-33730

CVE.ORG link : CVE-2026-33730

JSON object : View

Products Affected

opensourcepos

  • open_source_point_of_sale
CWE
CWE-639

Authorization Bypass Through User-Controlled Key