CVE-2026-33730 Open Source Point of Sale has an IDOR in Password Change (Home)

Medium 6.5 Published 27 Mar 2026 Updated 27 Mar 2026

Authenticated low-privileged users can change other users' passwords, including administrators, by manipulating the employee_id parameter due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33730?

CVE-2026-33730 is a medium-severity missing authorization vulnerability in opensourcepos, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.

Weakness: CWE-639

Which versions are affected by CVE-2026-33730?

It affects 1 product.

Products include Opensourcepos Open Source Point of Sale.

How do I fix CVE-2026-33730?

No fix has been published for CVE-2026-33730 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33730 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33730 exists.

Sources

Also known as GHSA-mcc2-8rp2-q6ch.