CVE-2026-33730·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 2% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade PHP and OpenSourcePOS to version 3.4.2 or later to patch an IDOR vulnerability that allows authenticated users to modify password settings for other employee accounts, including administrators. This fix enforces proper authorization validation on employee resource access. Apply the update immediately, especially if your installation serves multi-user point-of-sale environments with varying privilege levels.

sudo dnf update php php-cli php-common php-curl php-gd php-json php-mbstring php-mysql php-opcache php-xml

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /employee/change_password.*employee_id=\d+ HTTP/1\.1.*Authorization: Bearer|Cookie:.*session.*[^0-9](?!\1)\d{2,4}[^0-9]

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement a WAF rule to enforce authorization checks on the /employee/change_password endpoint: block requests where the `employee_id` parameter differs from the authenticated user's own employee ID, unless the user has admin role. Log and alert on any authorization bypass attempts.

How to check if you are affected

1. Run `php -v` to check the installed PHP version and confirm if OpenSourcePOS is running on a version prior to 3.4.2.
2. Check the OpenSourcePOS installation directory for the version file: `grep -r 'version' /path/to/opensourcepos/application/config/ | grep -i config`
3. Search web server access logs for repeated requests to `/employee/change_password` endpoints with varying `employee_id` parameters from the same authenticated user: `grep 'employee.*change_password' /var/log/apache2/access.log | grep -oP 'employee_id=\d+' | sort | uniq -c | sort -rn`
4. Verify the patch by checking the git commit hash in the OpenSourcePOS installation: `cd /path/to/opensourcepos && git log --oneline | head -20 | grep 'ee4d44e'`

FAQ

Related PHP CVEs

References

• https://github.com/opensourcepos/opensourcepos/commit/ee4d44ed396097d6010c5490ab4fd7cfae694624
• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-mcc2-8rp2-q6ch