PT-2026-28516 · Unknown · Open Source Point Of Sale

Venukamatchi · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-33730

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale (opensourcepos) versions prior to 3.4.2

Description The application is a web-based point of sale system written in PHP using the CodeIgniter framework. A security issue exists where an authenticated user with limited privileges can access the password change functionality for other users, including administrators. This is possible by manipulating the employee id parameter without proper authorization checks or verification of object ownership. The application does not verify that the current user has permission to modify the account associated with the specified employee id. Version 3.4.2 introduces object-level authorization checks to validate ownership of the employee id being accessed.

Recommendations Versions prior to 3.4.2 should be updated to version 3.4.2 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33730

Affected Products

Open Source Point Of Sale

References · 5

• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch · Vendor Advisory
• https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33730 · Security Note
• https://twitter.com/CVEarity/status/2037485484688199707 · Twitter Post
• https://twitter.com/CVEnew/status/2037513389606371471 · Twitter Post