CVE-2026-111870: itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication
A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely without authentication or user interaction. Public exploit information is available, which increases the likelihood of attempted attacks.
Which deployments should be treated as potentially affected?
Deployments using itsmeravitejak Online-Examination-System should be treated as potentially affected if they include the vulnerable isAdmin function in admin/admin.php. The product uses rolling releases, so no fixed affected or remediated version range is available.
How can defenders check for exposure?
Review the deployed admin/admin.php implementation, specifically the isAdmin function, for the authentication bypass condition described in the issue. Also review access and application logs for unexpected remote requests to administrative functionality.
What should be done if no vendor fix is available?
Restrict remote access to administrative functionality and limit it to trusted networks or authenticated reverse-proxy access where possible. Monitor for attempted access to admin endpoints, because the project was notified but had not responded at the time of publication.