CVE-2026-2174 is an improper authentication flaw in code-projects Contact Management System 1.0, scored 7.3 (High). The CRUD endpoint handles the ID argument without proper authentication checks. The record lists no fixed version. Keep the app off public networks, and add an authentication check if you maintain the code.
What's affected
- Product: code-projects Contact Management System
- Affected version: 1.0
- Component: the CRUD endpoint, through the ID argument
- Fixed version: none listed in the record
- Status: The CVE is not in the CISA Known Exploited Vulnerabilities catalog. The record does not mention a public exploit, and it does not claim attacks in the wild.
The record gives few details, such as the exact file name, so confirm the behaviour in your own copy.
How to check if you're exposed
Look for the app first. The record gives no file path, so search by the typical create, read, update and delete scripts:
grep -rIl "contact" /var/www /srv /opt --include=*.php 2>/dev/null | head -20
When you find a copy, test from an unauthenticated session whether the data handling pages answer without a login. They should redirect to sign in or refuse. Then check for contact records you did not create or edit.
What to do now
- Find every copy of the app and decide whether it needs to be online at all.
- Put it behind a VPN or an allow list of known addresses.
- Add a session check at the top of every script that reads or changes contact records.
- Back up the data, then review it for unexpected changes.
- Check the vendor site for a newer release, and plan to retire the app if none appears.
Why it matters
The record files this under CWE-287, improper authentication. In a CRUD endpoint, that means the code that creates, reads, updates or deletes records can be called without proving who is asking. Contact lists often hold names, emails and phone numbers, so unauthorised reads and edits matter.
The common cause in small PHP projects is that the login page checks the user, but the action scripts behind it do not. Each script runs on its own and has to repeat the check.
The record is brief, and no vendor patch is listed. Treat the app as unsafe for public use until you have added checks yourself.
Quick check
Is there a patch?
The record lists none. Check the project page and the vendor site.
Where is the vulnerable file?
The record names the CRUD endpoint and the ID argument and gives no file path, so review all of the record handling scripts in your copy.
Sources
The VulDB page listed in the record did not return readable content when checked, so the details here come from the CVE record itself.
Last reviewed: 19 October 2026.
