A security flaw has been discovered in CodeAstro Complaint Management System 1

CodeAstro Complaint Management System 1.0 is a free open-source PHP/MySQL learning project distributed via codeastro.com — the same vendor whose Student Attendance, HR, and Restaurant POS scripts cycle through the CVE feed weekly. CVE-2026-13549 is tagged CWE-285 Improper Authorization, vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, meaning an unauthenticated remote attacker can trick an authenticated user into triggering a state-change (likely a complaint create/edit/delete or status flip) that the app fails to verify ownership on. No confidentiality loss, only partial integrity and availability of complaint records.

Vendor severity of MEDIUM 5.4 is generous. These CodeAstro CVEs are bulk-submitted student/researcher findings against tutorial code that has effectively zero enterprise deployment. The CVSS math is correct for the bug class, but the deployment population is hobbyists, students, and a handful of small businesses running it as-is. For a defender managing 10,000 hosts, the realistic probability this software is in your fleet is near zero — and if it is, the bug is the least of your problems.

Why this verdict

• Install-base floor: CodeAstro ships learning-project PHP scripts; commercial inventory feeds (Censys/Shodan) show only small hundreds of global instances. No high-value-role variant of this component exists — there is no 'domain controller version' of a complaint form.
• Friction stack: UI:R cookie+click requirement, modern SameSite=Lax browser defaults, and the C:N rating combine to cap real-world impact at low-integrity data tampering.
• Role multiplier: none applicable. The component is not in the high-value catalog (no IdP, hypervisor, CA, EDR, backup, CI/CD, or edge appliance role). Even worst-case deployment is a public complaint intake page — fleet/identity/supply-chain blast radius is structurally impossible.
• No exploitation signal: not on KEV, no GreyNoise activity, EPSS bottom-decile, no weaponized PoC.

Why not higher?

Vendor's MEDIUM 5.4 is a paper score from CVSS arithmetic; it ignores that the affected software is non-enterprise and the bug yields no confidentiality, no code execution, and no privilege escalation. There is no role multiplier available to lift this above LOW.

Why not lower?

Not IGNORE because the bug is real, unauthenticated, and trivially exploitable where the software does exist — small businesses and student projects running it as a public complaint intake form do see genuine record-tampering risk. Document and patch when convenient; do not pretend it's a non-issue.

1. Inventory whether CodeAstro Complaint Management System is anywhere in your estate — Run an asset query against your CMDB and external attack surface tool for codeastro, complaint-management, and the default install paths. If zero hits — and it almost certainly is zero — close the ticket. No mitigation SLA applies under noisgate LOW; this is backlog hygiene.
2. If found, place behind authenticated reverse proxy with strict Origin/Referer enforcement — Front the app with nginx/Caddy/Cloudflare and enforce same-origin POST. This neutralizes the CSRF delivery vector without touching the vulnerable code. Apply opportunistically within the 365-day remediation window.
3. Set application session cookies to SameSite=Strict; HttpOnly; Secure — Edit the PHP session config or inject the header at the proxy. Breaks the UI:R cross-site delivery path entirely for modern browsers.
4. Replace with a maintained product if it handles real grievance data — CodeAstro will not ship a patch. If the app processes regulated data (HR grievances, customer complaints), migrate to a maintained alternative — this is a posture problem, not a CVE problem.

Run from an auditor workstation with network reach to suspected hosts. Invoke as ./check_codeastro.sh https://target.example.com — no privileges required, just HTTP access. Reports VULNERABLE if the CodeAstro Complaint Management System fingerprint is detected, PATCHED if the path responds but with a different app, UNKNOWN on network or detection ambiguity.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13549
# CodeAstro Complaint Management System 1.0 — CWE-285 improper authorization
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE (fingerprint match), 2 = UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 https://host[:port]" >&2
  exit 2
fi

UA='noisgate-scan/1.0'
TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

# Common CodeAstro Complaint Management paths
PATHS=(
  '/'
  '/index.php'
  '/login.php'
  '/admin/'
  '/admin/index.php'
  '/complaint-management-system/'
  '/complaint/'
)

FOUND=0
ERRORS=0
for p in "${PATHS[@]}"; do
  url="${TARGET%/}$p"
  code=$(curl -sk -A "$UA" --max-time 8 -o "$TMP" -w '%{http_code}' "$url" || echo '000')
  if [[ "$code" == '000' ]]; then
    ERRORS=$((ERRORS+1))
    continue
  fi
  if grep -qiE 'codeastro|complaint[- ]management[- ]system|cms.*complaint' "$TMP"; then
    FOUND=1
    echo "fingerprint hit: $url (HTTP $code)"
    break
  fi
done

if [[ $FOUND -eq 1 ]]; then
  echo 'VULNERABLE — CodeAstro Complaint Management System detected; vendor has not published a fix for CVE-2026-13549'
  exit 1
fi
if [[ $ERRORS -ge ${#PATHS[@]} ]]; then
  echo 'UNKNOWN — target unreachable on all probed paths'
  exit 2
fi
echo 'PATCHED — no CodeAstro Complaint Management System fingerprint on probed paths'
exit 0

Sources

1. CISA KEV Catalog (not listed)
2. GitHub Advisory Database
3. VulDB CodeAstro vendor page
4. OpenCVE — CodeAstro vendor
5. CVE record for related CodeAstro flaw (CVE-2026-11584)
6. CWE-285: Improper Authorization
7. FIRST EPSS model
8. CodeAstro project site