How severe is CVE-2026-33730?

CVE-2026-33730 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-33730 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33730?

CVE-2026-33730 affects Opensourcepos Open Source Point Of Sale. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33730?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-33730 have an EU (EUVD) identifier?

Yes. CVE-2026-33730 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-16509.

When was CVE-2026-33730 published?

CVE-2026-33730 was published on 2026-03-27 and last updated on 2026-06-17.

CVE-2026-33730

CVE-2026-33730 is a medium-severity vulnerability in Opensourcepos Open Source Point Of Sale with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-639.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-16509
Weakness: CWE-639
Affected product: Opensourcepos Open Source Point Of Sale
Published: 2026-03-27
Last modified: 2026-06-17

Description

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.

Frequently asked questions

What is CVE-2026-33730?: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.
How severe is CVE-2026-33730?: CVE-2026-33730 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-33730 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33730?: CVE-2026-33730 affects Opensourcepos Open Source Point Of Sale. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33730?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-33730 have an EU (EUVD) identifier?: Yes. CVE-2026-33730 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-16509.
When was CVE-2026-33730 published?: CVE-2026-33730 was published on 2026-03-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*

More vulnerabilities in Opensourcepos Open Source Point Of Sale

CVE-2026-32888 — High (CVSS 8.8): Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions…
CVE-2026-26746 — High (CVSS 8.8): OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An…
CVE-2025-68434 — High (CVSS 8.8): Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…
CVE-2025-68147 — High (CVSS 8.1): Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…
CVE-2025-63800 — High (CVSS 7.5): The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty…
CVE-2025-70093 — High (CVSS 7.4): An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

All CVEs affecting Opensourcepos Open Source Point Of Sale →

Other CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities

CVE-2025-40805 — Critical (CVSS 10.0): Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an…
CVE-2024-45032 — Critical (CVSS 10.0): A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge…
CVE-2026-34037 — Critical (CVSS 9.9): Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to…
CVE-2026-52782 — Critical (CVSS 9.9): OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through…
CVE-2026-45552 — Critical (CVSS 9.9): Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior,…
CVE-2026-29200 — Critical (CVSS 9.9): A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and…

Browse all CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities →