CVE-2024-2576: High Access Bypass in Employee Task Management System

CVE-2024-2576 is a high severity (CVSS 7.3) authorization bypass in SourceCodester Employee Task Management System 1.0. The update-admin.php page uses the admin_id argument to pick a record without checking ownership. The record lists no fixed version, so restrict access or change the code.

What's affected

SourceCodester Employee Task Management System 1.0, as listed in the record's CPE data. The affected file is /update-admin.php. The admin_id argument selects a record and the page does not check that the user may access it. Any copy of that release should be assumed affected.

The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, published 2024-03-18. The weakness is classed as CWE-639 (authorization bypass through a user-controlled key).

The record names no fixed version and I found no vendor patch in its references. This is a small PHP project of the kind distributed as sample code, so a patch from the original author is unlikely to arrive on any schedule you can plan around.

How to check if you're exposed

This is source code you deploy, so start with the version. Check the version file, the release tag or the download you used, and confirm whether it is SourceCodester Employee Task Management System 1.0.

Then look for the vulnerable file in your web root:

find /var/www -name 'update-admin.php' 2>/dev/null

If the file exists on a server that anyone other than you can reach, assume it is exposed. Web server logs for the file name can show who has requested it.

What to do now

1. Find every instance of the application, including test and demo copies, and note who can reach it.
2. Take it off any network that is not trusted until it is fixed or replaced.
3. If you must keep it, change the code yourself using the fix described under Why it matters, and test it.
4. Put the application behind a login at the web server or a VPN so unauthenticated visitors cannot reach it.
5. Review the application and database logs for unexpected requests to update-admin.php.
6. Plan a move to a maintained product if the data is business relevant.

Why it matters

The weakness is an authorization bypass through a user-controlled key, often called an insecure direct object reference. The page takes an identifier from the request and uses it to load or change a record, but it does not check that the signed-in user is allowed to touch that record. Changing the identifier changes whose data is returned or modified.

The fix is an ownership or role check on the server for every record access, using the identity from the session and never trusting the identifier alone. Random identifiers help a little but are not a substitute for the check.

This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.

Quick check

Sources

• NVD record for CVE-2024-2576

Last reviewed: 19 October 2026.