toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdir…

CVE-2026-71252 affects the toner-management web application, where admin state-changing handlers (add.php, edit.php, delete.php) under multiple admin subdirectories performed database INSERT, UPDATE, and DELETE operations without any authentication or authorization checks. Access control was only enforced on listing views, leaving action handlers fully exposed. An unauthenticated remote attacker could directly invoke these handlers to create, modify, or delete application data. The vulnerability impacts admin sections covering toners, toner-brands, printers, and related resources. The vendor has merged a fix that requires a valid authenticated admin session before any state-changing handler is executed. This represents a broken access control issue with high impact on data integrity and availability.