CVE-2026-100878: zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The reported attack vector is network-based and requires low privileges. No user interaction is required, so an authenticated low-privileged user who can reach the affected endpoint is the relevant exposure scenario.
Which versions are known to be affected?
zhistaredu StarTraining versions up to and including 3.8.1 are identified as affected. The provided information does not identify a fixed version.
What access could an attacker gain through exploitation?
Manipulating the userId or roleIds argument in the authRole endpoint can bypass authorization checks in SysUser.isAdmin. The reported impact includes limited compromise of confidentiality, integrity, and availability.
How urgent is remediation?
The issue is rated medium severity with a CVSS score of 6.3, but a public exploit is available and may be used. Prioritize systems where low-privileged accounts can access the affected endpoint.
Is vendor remediation available?
The supplied information does not list a patch or workaround. It states that the vendor was contacted before disclosure but did not respond.