CVE-2026-94048

Name of the Vulnerable Software and Affected Versions CodeAstro QR Code Attendance Management System version 1.0

Description Improper privilege management exists in the Save() function within the app/Controllers/UserController.php file. A remote attacker can manipulate the role id argument to gain unauthorized privileges.

Recommendations Restrict access to the Save() function in the app/Controllers/UserController.php file or avoid using the role id argument until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.