CVE-2023-49978 is a high severity (CVSS 8.8) incorrect access control flaw in Customer Support System v1, a PHP and MySQL sample project. Non administrator users can open admin pages and run admin actions. No fixed version is named, so remove the application or restrict access to it.
What's affected
The record names Customer Support System 1.0 (published through SourceCodester). The weakness is CWE-284 (improper access control). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which needs a low privilege account.
The researcher's page for the CVE says the flaw lets regular users modify other users' accounts and delete users. It notes a disclosure date of 29 November 2023 and mentions no patch, vendor reply or remediation, and its repository has no releases.
Fixed versions: none are named in the sources I read. I found no vendor advisory. Treat all copies as vulnerable.
How to check if you're exposed
Find out whether you run this application. It is a downloadable sample project, often used for learning or small internal tools, so it may sit on a forgotten server.
grep -ril "sourcecodester" /var/www 2>/dev/null | head
Look in the application's admin folder and check whether pages there test the user's role before they run. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every copy of the application and decide whether it is still needed.
- If it is not needed, remove it. A sample project is rarely worth keeping online.
- If it must stay, put it behind a login at the web server and restrict it to trusted networks.
- Turn off directory listing in the web server and block access to upload, backup and configuration folders.
- Review the data the application holds and treat anything exposed as readable by others.
- Do not reuse passwords from this application anywhere else.
Why it matters
Admin pages in this kind of application are meant to be reached only by admin users, but the application does not enforce that. A low privilege account can open them directly.
The risk is bigger when the application allows self registration, since anyone can then obtain the account the flaw requires. This CVE is not on the CISA KEV list.
Quick check
Is there a patch?
None is named in the sources I read.
Does it need an account?
Yes, a low privilege one, per the vector.
Sources
Last reviewed: 19 October 2026.
