CVE-2026-33730

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624	Patch
https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-27 01:16

Updated : 2026-06-17 10:38

NVD link : CVE-2026-33730

Mitre link : CVE-2026-33730

CVE.ORG link : CVE-2026-33730

JSON object : View

Products Affected

opensourcepos

open_source_point_of_sale

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-33730", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33730", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T13:26:14.486059Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opensourcepos", "product": "opensourcepos", "versions": [{"status": "affected", "version": "< 3.4.2"}]}]}], "published": "2026-03-27T01:16:20.577", "references": [{"url": "https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed."}, {"lang": "es", "value": "Open Source Point of Sale (opensourcepos) es una aplicaci\u00f3n de punto de venta basada en la web escrita en PHP utilizando el framework CodeIgniter. Antes de la versi\u00f3n 3.4.2, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) permite a un usuario autenticado con bajos privilegios acceder a la funcionalidad de cambio de contrase\u00f1a de otros usuarios, incluidos los administradores, manipulando el par\u00e1metro 'employee_id'. La aplicaci\u00f3n no verifica la propiedad del objeto ni aplica comprobaciones de autorizaci\u00f3n. La versi\u00f3n 3.4.2 a\u00f1ade comprobaciones de autorizaci\u00f3n a nivel de objeto para validar que el usuario actual es propietario del 'employee_id' al que se accede."}], "lastModified": "2026-06-17T10:38:00.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "401D867E-4CA1-48F9-9C5D-492BCAAC8106", "versionEndExcluding": "3.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}