CVE-2026-86275: SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management
A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Remote, unauthenticated attackers can exploit it. The vulnerability is in the registration flow, so an attacker does not need an existing account or user interaction.
What access could an attacker gain?
Manipulating the role argument during registration can cause improper privilege assignment. The available information confirms an integrity impact, but does not specify which elevated roles can be obtained.
Is exploit code available?
Yes. The exploit is public, which increases the likelihood of attempted exploitation against accessible deployments.
How can I determine whether my deployment is affected?
The affected product version identified is 1.0. Review registration requests and newly created accounts for unexpected role values or accounts assigned privileges beyond the normal default registration role.