PT-2026-28516 · Unknown · Open Source Point Of Sale

Venukamatchi · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-33730

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale (opensourcepos) versions prior to 3.4.2

Description The application is a web-based point of sale system written in PHP using the CodeIgniter framework. A security issue exists where an authenticated user with limited privileges can access the password change functionality for other users, including administrators. This is possible by manipulating the employee id parameter without proper authorization checks or verification of object ownership. The application does not verify that the current user has permission to modify the account associated with the specified employee id. Version 3.4.2 introduces object-level authorization checks to validate ownership of the employee id being accessed.

Recommendations Versions prior to 3.4.2 should be updated to version 3.4.2 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-33730

Produtos afetados

Open Source Point Of Sale

Referências · 5

• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch · Aviso do Fabricante
• https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-33730 · Nota de Segurança
• https://twitter.com/CVEarity/status/2037485484688199707 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037513389606371471 · Publicação no Twitter