CVE-2026-78142

CVE-2026-78142 is an IDOR in archived_records.php where the Restore (and likely Delete) function accepts a resident_id parameter without verifying that the authenticated user owns or is authorized to act on that specific record. The vulnerability is trivial to exploit: intercept the request, change the resident_id to any archived record, and the operation completes. This is not a sophisticated bug — it's the absence of an authorization check where a parameter value determines what data gets modified. The immediate fix is straightforward: add a check that the current user's role or scope permits the operation on the target record. But patching this one function is insufficient. The pattern here — IDOR in archived, history, or admin endpoints — is a documented recurring vulnerability family. Archived code gets mentally reclassified as 'historical' and therefore 'less consequential,' which means it receives less security scrutiny during development and less attention in sprint reviews. If this endpoint was forgotten, others likely were too. Worse, small civic software vendors typically deploy functionally identical codebases across dozens of municipalities. A surgical patch to your instance creates a false confidence effect while functionally identical vulnerabilities persist in sibling systems you don't control. Your vendor's answer to 'is this the only gap?' will almost certainly be 'we fixed this one endpoint.' The CVSS 6.3 score badly distorts this vulnerability's actual severity in a civic context. A Barangay system (Philippines local government) handles residency records that determine evacuation eligibility, welfare services, polling assignments, and protection order status. The blast radius of a successful IDOR exploit isn't bounded by this application — it's as wide as every government database that trusts resident identifiers from this source. What scores as 'medium' in enterprise terms is 'critical' when the data determines who gets evacuated first. Action checklist: audit every archived/history/deprecated endpoint in this codebase for similar IDOR patterns before an attacker enumerates them; contact the vendor and ask whether their patch is a single-function fix or an authorization middleware layer (the latter is rare but necessary); review data federation — what other systems ingest resident_id from this platform and do they have their own exposure if this data is leaked; treat the CVSS score as a lower bound, not an accurate assessment, given what's actually at stake.

Reviewed through automated stages and approved by a human before publication.