{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "CVE-2026-30764",
    "assignerOrgId": "00000000-0000-4000-8000-000000000000",
    "assignerShortName": "MITRE",
    "state": "RESERVED",
    "dateReserved": "2026-03-30T00:00:00.000Z",
    "dateUpdated": "2026-10-21T00:00:00.000Z"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "00000000-0000-4000-8000-000000000000",
        "shortName": "MITRE",
        "dateUpdated": "2026-10-21T00:00:00.000Z"
      },
      "title": "Authentication bypass in admin account creation (/admin/functions/new_admin.php)",
      "descriptions": [
        {
          "lang": "en",
          "value": "Obed Nyakundi Rental House Management System 1.0 contains an authentication bypass vulnerability in /admin/functions/new_admin.php. The application processes user creation requests without validating administrative sessions or credentials. This allows a remote attacker to gain full administrative access by creating a new account. A CVE identifier has been reserved with MITRE and is pending a public reference record."
        }
      ],
      "affected": [
        {
          "vendor": "Obed Nyakundi",
          "product": "Rental House Management System",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "lessThan": "not released"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-306",
              "type": "CWE"
            }
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL"
          }
        }
      ],
      "references": [
        {
          "url": "https://github.com/ObedNyakundi/Rental-house-management-system",
          "name": "Vendor source repository"
        }
      ],
      "timeline": [
        {
          "time": "2026-03-30T00:00:00.000Z",
          "lang": "en",
          "value": "CVE-2026-30764 reserved with MITRE."
        },
        {
          "time": "2026-10-21T00:00:00.000Z",
          "lang": "en",
          "value": "Public advisory published as the reference required for MITRE to publish the reserved CVE record."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Mikołaj Kołodziej"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Require a validated administrative session before processing any request that creates or modifies administrator accounts. Reject unauthenticated and non-administrative callers at the access-control layer, and review related administrative endpoints for the same missing authentication check. Until a vendor fix is available, restrict public network exposure of the application and place administrative paths behind additional access controls."
        }
      ]
    }
  }
}