CVE-2026-75458: XueZhiSi Open Source Exam System XueZhiSi Open Source Exam System vulnerability
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated teacher account with role=2 can exploit the vulnerable teacher-end endpoint. The attacker must be able to send a POST request to /api/teacher/user/delete/{id} with the ID of a target account.
What is the impact of successful exploitation?
A teacher can mark an administrator account with role=3 as deleted. This allows a lower-privileged user to perform an administrative account deletion action.
Are administrator accounts the only affected targets?
The described endpoint does not validate whether the current teacher has authority to delete the target user before loading the supplied ID and marking that user as deleted. The confirmed impact described is deletion of administrator accounts.
How can defenders check for possible exploitation?
Review requests to the teacher-end POST endpoint /api/teacher/user/delete/{id}, particularly requests made by role=2 teacher accounts that target administrator user IDs. Also investigate administrator accounts that have been unexpectedly marked deleted.