CVE-2026-75460: XueZhiSi Open Source Exam System vulnerability
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.
Affected Software
Event History
Frequently Asked Questions
What attacker access or prerequisites are documented?
The available information states that the requester can fully control the role parameter sent to the teacher-end POST /api/teacher/user/page/list endpoint. It does not specify authentication requirements, required user roles, or whether the endpoint is accessible without an authenticated session.
How can I identify potentially affected instances?
Review deployments of XueZhiSi Open Source Exam System and identify those running version 3.9.0 or earlier. The issue is associated with the teacher-end user-list endpoint at /api/teacher/user/page/list.
Is a workaround available if updating cannot be performed immediately?
No configuration workaround or compensating control is provided in the available information. The supplied reference points to a source-code comparison containing a patch.